Content-Type: text/plain;
	charset=utf-8
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3818.100.11.1.3\))
From: Joe Abley <jabley@strandkip.nl>
In-Reply-To: 
 <CAMEWqGukY1JG+ZrNZbB5kX5jYobdyStaLr1-60o+GpQ+w9iaQw@mail.gmail.com>
Date: Wed, 23 Oct 2024 13:27:29 +0200
Content-Transfer-Encoding: quoted-printable
Message-Id: <4AB5D06A-3F75-45D3-9790-B0DF31C73325@strandkip.nl>
References: 
 <CAMEWqGuteXVkJdXfn3Ls4+kFXQ+ZTDFvT23Y7O8iKNJhFfOwng@mail.gmail.com>
 <BB5B0F75-E4FB-40FB-9A5A-6DB9A9B31FDD@ripe.net> <Zr326KAHIudi-gdh@snel>
 <D93F6B52-AE7E-4BA2-A753-23AADA31F609@e43.eu> <ZxeayWl_0X9XMvYF@fast>
 <95820DD3-7761-4494-B1AD-ECEF3D4756FF@e43.eu> <ZxevubypBaInibZ8@fast>
 <14D7E118-573C-4BB4-B867-A674115691ED@e43.eu> <Zxf1O4ExSJath0MI@fast>
 <CAMEWqGukY1JG+ZrNZbB5kX5jYobdyStaLr1-60o+GpQ+w9iaQw@mail.gmail.com>
To: Q Misell <q=40as207960.net@dmarc.ietf.org>
Message-ID-Hash: OLFMLUL2NYP5CNXGBIFVGJNS4BFBX6EE
CC: Job Snijders <job=40fastly.com@dmarc.ietf.org>,
 Erin Shepherd <erin.shepherd@e43.eu>, grow@ietf.org, sidrops@ietf.org
Precedence: list
Subject: =?utf-8?q?=5BSidrops=5D_Re=3A_=5BGROW=5D_Peering_API_Discovery_-_Use_of_sign?=
	=?utf-8?q?ed_checklists?=
Archived-At: 
 <https://mailarchive.ietf.org/arch/msg/sidrops/dfiGwZF5NT7G3dWHiFu9mUldxBI>

On Oct 23, 2024, at 13:02, Q Misell <q=3D40as207960.net@dmarc.ietf.org> =
wrote:

> > Automation systems would never receive a RSC without first having =
sent out instructions about what's expected in the RSC's payload.
>=20
> Whilst this is on the surface correct, it misses the point. Consider =
the following:
>     =E2=80=A2=20
> System A expects an RSC in format A
>     =E2=80=A2 System B is unaware of format A, and is thus unaware of =
the consequences of signing an RSC in format A
>     =E2=80=A2 User A asks System B to create an RSC in format A
>     =E2=80=A2 System B happily obliges, not knowing the consequences =
of what it is signing
>     =E2=80=A2 System A accepts the RSC from User A - even if User did =
not have the required permissions within the organisational scope of =
System B to do so
> > I suspect purpose can be derived from context in which the RSCs are =
sent/received.
>=20
> Independent systems can derive different expected purposes from =
context if we're not explicit about it.


I am interested in this.

Customers who want to do the BYOIP onboarding dance with multiple =
service providers might appreciate having consistent instructions from =
all concerned about what payload to sign and submit. This would also =
make it easier to use a single toolchain for multiple providers. Seems =
like exactly the kind of scenario where we normally expect interop to be =
useful.

I think it's a nice feature that signed checklists by design are =
flexible and payload-agnostic, but perhaps there is some benefit in =
specifying the format of specific documents to be used in specific =
circumstances (like 'BYOIP onboarding') as well.

Having said all of that, this is all quite new to me and I am standing =
by to receive education :-)


Joe