Re: [saag] should we revise rfc 3365?

[Mouse <[e-mail]>]

> Short version: go read [RFC 3365] and say if you think it needs an
> update.

Yes, but I believe it's not one you're willing to accept.

> "MUST implement strong security in all protocols"

I believe this is too dogmatic a position, and will simply lead to IETF
process being ignored in those cases where strong security is
unnecessary or undeisrable.  Consider, for example, the number of
useful protocols we have today that could not be standardized under
this policy: whois, SMTP, and DHCP come to mind.  Based on a quick skim
of the specs, NFS is another one (even v4 doesn't seem to have MTI
security, only an MTI framework within which security can optionally be
done - but that's just a quick skim; I could easily have missed
something).

I know that, as an occasional protocol designer, if I believe a
protocol has no need for security, I would sooner ignore the IETF than
I would bother with shoehorning enough security to satisfy the IETF
into it.

Aside from this excessively (I believe) dogmatic position, I see
nothing wrong with 3365.

/~\ The ASCII				  Mouse
\ / Ribbon Campaign
 X  Against HTML		[e-mail]
/ \ Email!	     7D C8 61 52 5D E7 2D 39  4E F1 31 3E E8 B3 27 4B