Re: [Patient] [saag] Internet Draft posted as requested -

[Melinda Shore <[e-mail]>]

On 12/18/17 10:15 AM, Paul Wouters wrote:
> I also detect a culture clash where I see a lot of praise to proponents
> and opponents without technical backing. At the IETF, we try to
> reach consensus based on technical merit, for example by stating you
> agree or disagree with certain items and why, and don't do "me too"
> messages to get a count.

Right, this is not how we do consensus.  Consensus is not voting
without formal votes.

At any rate I'm not sure that business models and technical decisions
are that cleanly separable.  We've decided, for example, that the
IETF is not going to develop "walled garden" technologies, and so
on.

This particular discussion is one we've been having for several
decades.  When the problem of getting encrypted session signaling
(i.e. VoIP) protocols through firewalls and NATs came up there
was a similar tension between what people concerned about application
security wanted and what middlebox vendors wanted, since middlebox
vendors had established a lot of value in their products and
were concerned that moving application logic outside of the
middlebox (through a middlebox signaling protocol) would undermine
that value.  There were proposals for session key sharing at that
time but the IETF made the decision that this was terrible security
practice and instead took an approach that ultimately didn't get
any traction because middlebox vendors wouldn't implement it.

So, we've been here before.  That said, I think the decision not
to share session keys was a sound one at that time and remains
a sound one today.  We can't avoid having business model impacts,
and the work being brought to the IETF typically reflects someone's
business needs, but I do think we can continue to draw firm lines
around clearly unsound security practices.

Melinda


-- 
Software longa, hardware brevis

PGP fingerprint: 795A 714B CD08 F996 AEFE
                 AB36 FE18 57E9 6B9D A293