Re: [Secdispatch] [Smart] New Version Notification for draft-lazanski-smart-users-internet-00.txt

I personally think the biggest value at this stage is awareness and discussion.  So I would love to see this continue as a regular update item for sec dispatch.  I would also love to see regular and multiple side meetings.  I would also love to see SMART get officially chartered. 

I fully understand and get that we in the IETF generally focus on on-the-wire protocols.  However, I think we can design better and more secure solutions once we more completely understand the entire security pie.  Understanding operational security requirements and regulatory compliance requirements is critical for the success of the solutions we create here in the IETF.

Bret 

Sent from my Commodore 128D

PGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 0050

> On Jul 14, 2019, at 4:56 AM, Eliot Lear <lear@cisco.com> wrote:
> 
> Hi Melinda,
> 
>> We
>> typically deal with wireline protocols and their support
>> structures, and I'm hoping that as the discussions progress
>> people can be clear about what they'd like to see from the
>> IETF.
> 
> I think you’re primarily referring to leaky user databases here.  I agree with you that we cannot fix organizations’ bad internal code with a wireline protocol.  However, to exploit the vulnerability, the attack had to come from somewhere.  We already have one mechanism to address profiling with IoT that manufacturers can use to keep their systems from being exploited as BoTs.  The next question is whether we should be promoting or improving other mechanisms to provide people at home and elsewhere more visibility in terms of what their general purpose computing devices are doing.  I’m thinking of PCP in particular.  And while there may be more we can do, there may also be some limitations relating not only to privacy but also economics of web services.
> 
> What I like about Dominique’s draft is that it gets us thinking in those directions (or at least it did me).
> 
>> 
>> I do think that some of this may be appropriate for opsec,
>> as well, or at least should be called to their attention.
> 
> Or an RG or a side meeting.  It would be fun to continue the discussion.
> 
> Eliot
> 
>> 
>> Melinda
>> 
>> --
>> Melinda Shore
>> melinda.shore@nomountain.net
>> 
>> Software longa, hardware brevis
>> 
>> 
>> 
> 
> _______________________________________________
> Secdispatch mailing list
> Secdispatch@ietf.org
> https://www.ietf.org/mailman/listinfo/secdispatch