Re: [secdir] [Last-Call] Secdir last call review of draft-foudil-securitytxt-08

[Randy Bush <[e-mail]>]

>>> Right now the standard is begging on twitter for a chain of
>>> introductions.
>> 
>> and it works, i am embarrassed to say.  and one hears about outages
>> on the ops lists before one sees the automatic outage detector
>> reports.  sitting across the hudson, i heard of the wtc attack on
>> nanog almost two minutes before it came on television.
> 
> I do hear many stories about twitter letting people get in touch with
> the right organizational contact; a lot of them even "make the news"
> for some definition of "news".  I wonder if they remain newsworthy
> because achieving success is far from guaranteed, whether by
> "traditional" methods or by twitter.

probably because, as with 47.2% of what the press publishes, it sells
papers.

but no, i am not pleased that the most used sources of security and net
failure notifications are twitter and a few mailing lists.  and don't
get me started about the certs as information hoarders.

>> these half-assed "the market demands something" panaceas provide
>> false solutions we have to clean up later; emphasis on that last
>> clause.  rwhois anyone?  the highway is littered with whitepages
>> roadkill.  today there is a massive problem with authority in the IRR
>> (which some RIRs throw in with whois); and retrofitting a solution is
>> now years in blah blah blah.
>> 
>> no one is asking for the perfect over the good.  but it is our
>> obligation, before putting the ietf stamp on it, for it to be as good
>> as we can reasonably get for the time.  this proposal is not, as has
>> been enumerated time and again as it has been shoved through the
>> process over objections.
>> 
>> imiho, tero's review stands.
> 
> I do note the second 'i', but I have to say that to me, "shoved
> through the process over objections" sounds like a pretty serious
> process violation that ought to be remedied.

that may be what you heard, but that is not what i said, or at least
meant to say.

> I'd like to better understand what you see as the process violation
> (if any) here, so that I can try to remedy it.

if i had a process objection, i would say it quite clearly.  i have a
reputation to maintain :)

technical objections have been raised all along the path of this
document.  many of them ignored and repeated, many covered in tero's
most excellent secdir review.  but the draft marched on.  today sm
raised new issues.

but you're a security guy, have the badge and all, even if your name is
not steve.  read the darn thing and tell us what you think of it as
reasonable and prudent secops practice.

randy