Re: [saag] keys under doormats: is our doormat ok?

On Sun, Jul 12, 2015 at 3:28 PM, Dave Crocker <dhc2@dcrocker.net> wrote:
> On 7/12/2015 11:10 AM, Carsten Bormann wrote:
>>> I disagree. Publishing an update signals that our opinion has evolved.
>>> It hasn't, even if the technology has evolved to make software the focus
>>> rather than hardware. Besides, this kind of document is a huge rathole,
>>> and I don't believe any minimal changes would be worth the hassle.
>>
>> I completely agree.
>>
>> Just as we elevated RFC 20 to STD, we could still elevate it to BCP -- a
>> status that, IIRC, was just becoming available at the time RFC 1984 was
>> published.
>
>
> First, in the world of politics -- and any other environment that has
> folk looking to squash views they don't like -- people will use anything
> they can find to undermine such views.  The fact that a decision is 20
> years old really does sway some folk.  It does not matter whether it
> should.  What matters is whether such folk matter.
>
> As often as we have people conducting protracted threads on IETF lists
> with silly crazies, on the off-chance that someone, somewhere, will take
> the crazy seriously, we need to pay attention to the potential that the
> IETF position of 20 years ago will be dismissed because it was made 20
> years ago.

The other factor is that we are entirely irrelevant to the discussion
this time around. Solutions like TextSecure use proprietary protocols
and aren't federated at all. It's not like when we were the place
where IKE2 and co were standardized, in which case our opinion
mattered. Now it's about the strength of our arguments, and the extent
(minimal) to which we appear to represent a cross-section of the
relevant industry.

>
>      The question is not merely whether our views have changed,
>      but whether they apply to the current issue as well as the
>      one 20 years ago.
>
>      To have a consensus view that the current issue is the same
>      as 20 years ago is an example of something that constitutes new
>      work.  So even if we think there is nothing new to say, there is
>      something extremely important to say that is new.
>
> I will suggest that it would be worth publishing a revised version of
> the previous RFC, with the addition of some text that explains how that
> previous decision applies to the current topic.  And or how the current
> topic is the same as the previous topic and that the IETF position
> remains now as it was then.

If you actually read RFC 1984, you will note that it lists 4 policies
considered bad. One of those is mandating that keys are in the hands
of a third party, which is what is being proposed today. What would
this proposed revision add that would clarify that this is what is
being talked about? I do think we could have done a lot better: RFC
1984 doesn't contain a whole lot of argument: only conclusions. Don't
expect a repeat to be listened to.

>
> I will also suggest that we ought to have the IETF review of the draft
> RFC for this include a segment at an IETF plenary.  However we aren't
> likely to get a draft at that stage by 10 days from now and we almost
> certainly should not wait until the next IETF.
>
> So I suggest that one of the plenaries contain a capsule summary --
> bulleted list -- of the points folk think should be made in the
> revision, and that a 'sense of the room' be taken during the plenary.
> And that the result of that polling be cited in the IETF's documentation
> about the intended draft and then in the draft itself.
>
> I'm glad to offer review services for the bulleted list and/or the draft.
>
> d/
>
>
> --
> Dave Crocker
> Brandenburg InternetWorking
> bbiw.net
>
> _______________________________________________
> saag mailing list
> saag@ietf.org
> https://www.ietf.org/mailman/listinfo/saag

-- 
"Man is born free, but everywhere he is in chains".
--Rousseau.