Re: [perpass] Hasty PRISM proofing considered harmful

[Peter Saint-Andre <[e-mail]>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 10/24/13 1:43 PM, Ted Hardie wrote:
> On Thu, Oct 24, 2013 at 11:03 AM, Peter Saint-Andre
> <[e-mail] <mailto:[e-mail]>> wrote:
> 
> 
>>> I think SMTP TLS BCP would be a good idea. I think it should
>>> be independent of DANE, because of the status of the DANE
>>> document. I would be happy to work on it (and would be happy to
>>> collaborate with PSA to discuss similarities and differences).
>> 
>> Great. Let's talk in YVR about how to get that done so its a
>> real BCP that gets followed in the wild. If someone else is up
>> for helping I guess contact Alexey.
> 
> Before this thread emerged, I suggested the idea of having a chat 
> about this topic during the AppsArea session on Monday morning
> (and BTW there are no SEC area sessions opposite). That might be a
> good place to start.
> 
> 
> Are you thinking of this in terms of MSAs in the RFC 6409 sense, as
> well as MTAs?

I'm thinking about what Keith Moore posted in draft-moore-email-tls.
So yes, MSAs in the RFC 6409 sense (but also covering IMAP and POP).

> Though SMTP is used for both, the usefulness of things like DANE is
> likely to be different in the different contexts.
> 
> That hints, unfortunately, that there is a strong possibility that
> the best current practice may be best specified in relation to a
> specific use of a protocol rather than generally to the protocol.

So it seems.

We all need to up our game, but each of us might need to do so in
different ways.

Peter

- -- 
Peter Saint-Andre
https://stpeter.im/


-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.19 (Darwin)
Comment: GPGTools - http://gpgtools.org
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iQIcBAEBAgAGBQJSaXyMAAoJEOoGpJErxa2piAwP/23f/rQ9VpAfJlcsFGLHmwEB
haJoQpJ4DJFuH201p+5U4w8YeZyCRaH1qrAv+kVNTBuiZwqQilkKty8FoMAg3cTl
NK15NVMWmR78lgNAW0FsPsRvvGmuuZGEdER6IvtytbL1xJue18RuaKWXiA5ZPeub
aXwtV9s5Qkj3asXTJexXmZvBwGa1oA1tXJHzrsmHOTZf/72OYo1J5o4hjIRlgK2h
jxGXl8mv94flj0ySk6lr4/vbfxNeLHpMDyuXZm2wPGnRQbfFANd0XsuvNa/YGmIy
4nm3cWHxtcRL1nGoD0JI6tb9ekgMzLIVAu0stl5T2/l663ppTW40QqAXLNEpp/Xc
UaIOtq9pEy0BKlzaRCqotV1AEgdiu1u7Mygo+r7nqjCA1gJV9evtSUE7ESGkM9y5
NXu0pfdqmPXa8Y3v+DoXZADkCFuz/4Jwgtq0vpGsWW3YMltv5L5SRgH5WYu7T4VI
VFXHkt1GpNYqT6x5IygkFswQVsC7Reast2RfYIaohefQ0VljteDZCivJK8VGvh1g
ob4bWjhbYcBHPrWD/2GxorUWz6ZXELDGyB+BU7cf8GgYyo+nwGq0enk4X5iGKxCJ
Y8begsJ1USF1X4NLQQV/pYk2BK4ZqczYANRR1tAMOEedzNukO1RtNGf9aU9VRPvP
uCqJyTfuOkvDsQPKjs6v
=QKwx
-----END PGP SIGNATURE-----