Re: [secdir] [Last-Call] Secdir last call review of draft-foudil-securitytxt-08

[Benjamin Kaduk <[e-mail]>]

Hi Randy,

On Sat, Dec 28, 2019 at 10:44:31AM -0800, Randy Bush wrote:
> > Right now the standard is begging on twitter for a chain of
> > introductions.
> 
> and it works, i am embarrassed to say.  and one hears about outages on
> the ops lists before one sees the automatic outage detector reports.
> sitting across the hudson, i heard of the wtc attack on nanog almost two
> minutes before it came on television.

I do hear many stories about twitter letting people get in touch with the
right organizational contact; a lot of them even "make the news" for some
definition of "news".  I wonder if they remain newsworthy because achieving
success is far from guaranteed, whether by "traditional" methods or by
twitter.

> these half-assed "the market demands something" panaceas provide false
> solutions we have to clean up later; emphasis on that last clause.
> rwhois anyone?  the highway is littered with whitepages roadkill.  today
> there is a massive problem with authority in the IRR (which some RIRs
> throw in with whois); and retrofitting a solution is now years in blah
> blah blah.
> 
> no one is asking for the perfect over the good.  but it is our
> obligation, before putting the ietf stamp on it, for it to be as good as
> we can reasonably get for the time.  this proposal is not, as has been
> enumerated time and again as it has been shoved through the process over
> objections.
> 
> imiho, tero's review stands.

I do note the second 'i', but I have to say that to me, "shoved through the
process over objections" sounds like a pretty serious process violation
that ought to be remedied.  I'd like to better understand what you see as
the process violation (if any) here, so that I can try to remedy it.  I
note that the IETF LC period is still open, and I am closely reading all
the feedback (e.g., including Paul Hoffman's note that arrived a bit after
yours) and will make an assessment of whether there is IETF consensus to
publish the document based on the feedback received during the last call.
(Which is to say, I do not consider consensus to be a foregone conclusion.)

Thanks,

Ben