Re: [saag] software update for teeny-weeny devices

[Stephen Farrell <[e-mail]>]

On 11/10/16 04:48, Peter Gutmann wrote:
> Stephen Farrell <[e-mail]> writes:
>> On 09/10/16 03:22, Peter Gutmann wrote:
>>> It'd also be good to have a problem statement of some kind rather than just
>>> a shopping list of stuff, or some indication of where the authors are coming
>> >from when they create their list.
>>
>> The authors of the draft are just trying to reflect what happened at the
>> workshop (as it says in the draft).
> 
> So were there no requirements given at the workshop, no use cases? 

The workshop did not produce the one true list of requirements
nor use-cases, no. And nor should it have attempted to do that
IMO.

> At the
> moment it feels like being told the punchline of a joke, "And then the farmer
> said 'You'll have to take the sheep as well'" [0], but without the setup you
> can't tell what's going on.
> 
>> If the text of the draft gives the wrong impression about any of that, I'd
>> appreciate pointers to help us fix it.
> 
> It's not really the wrong impression, it's a very incomplete impression.  It's
> like a bunch of people got together and came up with a list of problems,
> without really specifying what it was they were trying to do. 

Is there a clue in the fact that it was called a workshop? ;-)

> I know in
> general what's being discussed, but without any requirements or use cases I
> can just make a whole pile of the problems discussed go away by saying "well
> don't do that, then", the prime example being the one I pointed out, if you
> ignore certificates, or throw away CRLs and use something more functional,
> then you don't have to worry about having a RTC.

If you read the text of the report as being a recommendation
for strict adherence to x.509 or rfc5280+revocation-checking
then we should fix it so it doesn't read that way. But I don't
think it does read that way, and it's certainly not intended
to be written that way, at least by me. Again, if you can
point out text that lead you to think that that'd be great and
we can fix it. (That's fine offlist if that's easier.)

Cheers,
S.

> 
> Peter.
> 
> [0] Obviously this is an Australian joke.
>