Re: [saag] should we revise rfc 3365?

Hiya,

On 05/24/2012 12:51 AM, Mouse wrote:
>> Short version: go read [RFC 3365] and say if you think it needs an
>> update.
> 
> Yes, but I believe it's not one you're willing to accept.
> 
>> "MUST implement strong security in all protocols"
> 
> I believe this is too dogmatic a position, and will simply lead to IETF
> process being ignored in those cases where strong security is
> unnecessary or undeisrable.  Consider, for example, the number of
> useful protocols we have today that could not be standardized under
> this policy: whois, SMTP, and DHCP come to mind.  Based on a quick skim
> of the specs, NFS is another one (even v4 doesn't seem to have MTI
> security, only an MTI framework within which security can optionally be
> done - but that's just a quick skim; I could easily have missed
> something).
> 
> I know that, as an occasional protocol designer, if I believe a
> protocol has no need for security, I would sooner ignore the IETF than
> I would bother with shoehorning enough security to satisfy the IETF
> into it.
> 
> Aside from this excessively (I believe) dogmatic position, I see
> nothing wrong with 3365.

So how would you phrase it so that we do get security
mechanisms defined in most all cases but not when they're
really really not needed (or fictional)?

Cheers,
S.

> 
> /~\ The ASCII				  Mouse
> \ / Ribbon Campaign
>  X  Against HTML		mouse@rodents-montreal.org
> / \ Email!	     7D C8 61 52 5D E7 2D 39  4E F1 31 3E E8 B3 27 4B
> _______________________________________________
> saag mailing list
> saag@ietf.org
> https://www.ietf.org/mailman/listinfo/saag
> 
> 