Re: [saag] draft-mm-wg-effect-encrypt-03 - Next Steps

[<[e-mail]>]

All,

One thing that occurs to me is that this document is in a sense a "Gap Analysis" document.   It seems to beg the question, "Now what?"  That is, what are the best practices or recommended solutions for the problems or gaps which have been documented?

For example, Section 2: Network Service Provider Monitoring mentions:

"The EFF reported several network service providers taking steps to prevent the use of TLS over SMTP by breaking StartTLS, preventing the negotiation process resulting in fallback to the use of clear text."

So then I wonder, what exactly is going on?   What is it that NSPs are hoping to see in clear text?   Is there more logging required?  A better API?   Do they just not know how to manage their mail servers correctly?

I notice that a new email list was just formed (DLNEX) "to discuss various latency characteristics that can be exposed by network elements or segments and to explore if there are any latency related attributes that can be utilized by upper layer. For example, could there be latency exposure that upper layer can utilize to plan how to distribute their content to the right edges to achieve optimal user experience?"

A very interesting question.  It leads me to wonder if there are other classes of information which need to be exposed (or logged) also?  And then doing so while maintaining privacy & security.  (I am also looking forward to the information that may be provided by the new PLUS WG.)

I wonder if this document, draft-mm-wg-effect-encrypt-03, may be the foundation document for something like a SECOps (Security Operations) group.  (As in v6Ops, we discussed best practices and user experiences of IPv6).   Maybe we can take each of the topics raised by draft-mm-wg-effect-encrypt-03 and dive more deeply into each one and really discuss the use cases, etc.
Of course, there is work being done in other WGs (ex. PLUS) which may prove to be a solution for some of these problems.   But, I really like the operational and topical approach taken by this draft and I wonder if it can be the seminal document for add-on work?  And a place to centralize some of these thoughts.   But, maybe SAAG is the home for this?
Am I completely out to lunch?  Or does this resonate with anyone else?
Thanks,
Nalini Elkins
Inside Products, Inc.
www.insidethestack.com
[phone]