Re: [Slim] Stephen Farrell's Block on charter-ietf-slim-00-06: (with BLOCK)

[Barry Leiba <[e-mail]>]

> I'm asking that the analysis be somewhat broader than only
> considering language. (On the basis that if we define how to
> add language then other personal attributes are likely to
> be similarly handled in the relevant protocols, UAs and servers.)
> If one did agree with that then I do think it ought be included
> in the charter.
...
> Right, I get that the gating thing is iccky, and Bernard rightly
> points out that even when we try do all that well, the end results
> might not be so great, which is a totally fair point.

OK... given all that, I, at least, can support asking the working
group to do that kind of analysis, and including it in the charter.
I'm just one voice, so I'd like to hear from the people who will
actually do the work.  In any case, I'm certain that we will need
people from the Security Area to work on this in the working group, if
it's going to be of any real value, and I have to ask the Security ADs
to make sure we have that -- more than one person, I think, and people
who will take an active role.

> How about something like this:
>
> "It is not unlikely that once there is a method for using language
> as planned here, some implementations may similarly handle other
> personal attributes. The wg will analyse the security and privacy
> issues arising from having UAs emit language or other similar
> attributes and then handle language attributes accordingly."

How does this work, appended to the charter (at the end)?:

"Adding language information to the control streams will have security
and privacy implications that must be understood and documented, as
any protocol would have to do.  Beyond that, this may open the door to
inclusion of other information that could be more security- or
privacy-sensitive than language preferences, and it could be important
to have a close look at that early on.  Therefore, this working group
will include in its work a broader analysis of security and privacy
implications of including such information in this manner.  That
analysis may be written as a separate document, or may be included in
the working group's primary document(s).  The Security Area will
provide necessary ongoing participation for that analysis, and this
requirement will not block progress on the working group's main work
if such participation is not available."

Maybe wordier than it needs to be, but I'd like to be clear.

Barry