Re: [Rats] draft-birkholz-rats-uccs

[Thomas Fossati <[e-mail]>]

On Sat, Mar 13, 2021 at 9:05 PM Laurence Lundblade
<[e-mail]> wrote:
> > On Mar 13, 2021, at 12:32 PM, Thomas Fossati <[e-mail]> wrote:
> > I see this in a slightly different way: we take a data format that has
> > a "secure by default" label on it and we strip off the very thing that
> > makes it secure.  Since we are changing its commonly understood
> > semantics, it's probably wise that we simultaneously state why and
> > when this is acceptable, along with the assumed threat model.
>
> Agree that something must be said for this reason.

cool

> Just don’t think it should go into the full set of security considerations or describing a designed solution because both vary by use case and problem domain. It is not possible to anticipate all the use cases and problem domains.
>
> We don’t have any standard that says how you should securely transfer particular data formats like HTTP, XML or JSON. There is no “Secure transfer of HTML” standard. Instead we have security protocols like TLS, COSE, JOSE and such which can be used to secure data in general.
>
> As I mentioned before, I think it would be good to split the document in two, something I hadn’t thought of before.

IMHO it seems more natural to have that (minimalist) something you
mention above narrated alongside the description of the UCCS mechanics
rather than splitting the two.

> But, I’m still OK with it as is. This is just a fun discussion :-)

True, I also learned something new about sailors and horse latitudes!

cheers,
-- 
Thomas