Re: [saag] Additions to RFC 3631?

["Tschofenig, Hannes (NSN - FI/Espoo)" <[e-mail]>]

Hi Nico, 

> On Wed, May 23, 2012 at 7:42 AM, Hannes Tschofenig
> <[e-mail]> wrote:
> > to me it is not clear who the target audience of the document is and
> what purpose it serves.
> 
> One target audience would clearly be those who don't wallow in the
> security area.  There's probably an unstated purpose of simple
> advertising, and maybe to have a tool to beat others with (ISTR
> someone trying to argue from absence of some definition in the
> security glossary, that is, using the security glossary as an
> authority).  Perhaps this document can serve as a summary
> applicability statement, say.  There is a risk is that we'll all just
> argue endlessly about various details, possibly leading to a bloated
> document.  But it does seem like a nice idea: to have a guide to an
> entire area's past output.
> 
> Nico

I would like to have a more precise target audience and purpose. 

For example, I make a differentiation between someone who actively
participates in the IETF (but in groups outside the security area) and
wants to address security in his or her favorite protocol design vs.
someone who does not even participate in the IETF. For the former group
we have http://tools.ietf.org/html/rfc3552, also the Sunday IETF
education session, potentially the SAAG meeting, various other IETF
related publications about ongoing security activities (e.g., IPJ). Now,
we also have some privacy related guidance they can look at
http://tools.ietf.org/html/draft-iab-privacy-considerations-02. 
In general, the difficulty is to keep the list of protocols and
recommended best current practice up-to-date. 

If we are, however, talking about engineers outside the IETF who should
also be given guidance about security (since they are supposed to use
IETF protocols as well) then things get a bit more complicated.
Typically, that has not been the audience of our documents. There are,
however, exceptions. Consider for example
http://tools.ietf.org/html/rfc6272 where Fred tried to provide guidance
for those working on smart grids/smart meters and it also includes a
list of protocols that he thought would be relevant for that specific
domain. The writing style is obviously quite different and assumes far
less knowledge about the IETF process and procedures. 

Ciao
Hannes