Re: [perpass] privacy/PM reviews of existing stuff

[Spencer Dawkins <[e-mail]>]

I should be assuming that everyone else has already thought of this, but ...

On 01/29/2014 09:50 AM, Dave Crocker wrote:
> On 1/29/2014 5:55 AM, Stephen Farrell wrote:
>> One idea that came up in Vancouver and that we (meaning at least
>> me:-) haven't had a chance to progress was the idea of trying to
>> get a team of folks together to go do privacy reviews of existing
>> RFCs. Or perhaps slightly differently, reviews that explicitly
>> consider pervasive monitoring, which might be more constrained
>> and a bit easier.
> ...
>> Now that we're in the run up to the London IETF, if some of you
>> had time to try self-organise that kind of thing that'd be great.
>> Any takers for trying to organise that?
>
>
> Doing reviews for attention to PM is really an experimental activity. 
> We don't have a track record of those specific types of reviews and I 
> believe we are some distance away from having a shared, usable model 
> of what to review for.
>
> But we do need to develop it.
>
> So I think what you are proposing actually ought to be its own 
> development project, with the goal of producing a document in the 
> realm of "Guidelines for doing Pervasive Monitoring Reviews of IETF 
> Specifications."

Dave's suggestion is likely a great second-wave suggestion.

I took Stephen's suggestion and offer of a room as a great first-wave 
suggestion, and I had assumed that we weren't talking about reviewing 
all 7000-odd existing RFCs, but that people likely have a few widely 
deployed protocols in mind where they're already worrying about privacy 
aspects, reviewing widely deployed protocols that people are already 
worried about would be useful on its own, and might very well be the 
basis for developing guidelines that Dave is suggesting.

So, the worriers would self-organize in London as a first step.

If I got that wrong, my bad, and I'll go annoy people about transport 
issues, of course :-)

Spencer