Re: [Slim] Stephen Farrell's Block on charter-ietf-slim-00-06: (with BLOCK)

[Stephen Farrell <[e-mail]>]

On 04/10/15 22:19, Barry Leiba wrote:
>> I'm asking that the analysis be somewhat broader than only
>> considering language. (On the basis that if we define how to
>> add language then other personal attributes are likely to
>> be similarly handled in the relevant protocols, UAs and servers.)
>> If one did agree with that then I do think it ought be included
>> in the charter.
> ...
>> Right, I get that the gating thing is iccky, and Bernard rightly
>> points out that even when we try do all that well, the end results
>> might not be so great, which is a totally fair point.
> 
> OK... given all that, I, at least, can support asking the working
> group to do that kind of analysis, and including it in the charter.
> I'm just one voice, so I'd like to hear from the people who will
> actually do the work.  In any case, I'm certain that we will need
> people from the Security Area to work on this in the working group, if
> it's going to be of any real value, and I have to ask the Security ADs
> to make sure we have that -- more than one person, I think, and people
> who will take an active role.
> 
>> How about something like this:
>>
>> "It is not unlikely that once there is a method for using language
>> as planned here, some implementations may similarly handle other
>> personal attributes. The wg will analyse the security and privacy
>> issues arising from having UAs emit language or other similar
>> attributes and then handle language attributes accordingly."
> 
> How does this work, appended to the charter (at the end)?:
> 
> "Adding language information to the control streams will have security
> and privacy implications that must be understood and documented, as
> any protocol would have to do.  Beyond that, this may open the door to
> inclusion of other information that could be more security- or
> privacy-sensitive than language preferences, and it could be important
> to have a close look at that early on.  Therefore, this working group
> will include in its work a broader analysis of security and privacy
> implications of including such information in this manner.  That
> analysis may be written as a separate document, or may be included in
> the working group's primary document(s).  The Security Area will
> provide necessary ongoing participation for that analysis, and this
> requirement will not block progress on the working group's main work
> if such participation is not available."
> 
> Maybe wordier than it needs to be, but I'd like to be clear.

Yep, but I could go with that anyway. And I'll try get folks who'll
help. And I accept that there's a chance we won't succeed in getting
a useful or any analysis done.

Cheers,
S.


> 
> Barry
>