Re: [Smart] [Secdispatch] New Version Notification for draft-lazanski-smart-users-internet-00.txt

[Bret Jordan <[e-mail]>]

Hello,


> Hmm... restricting the requirements according to what problems we think we know how to solve seems to be a bit of a systematic problem in the industry. 
> 
> Without taking the position on the industry as a whole, the E in IETF stands for "engineering", so I think trying to solve problems we know how to solve is prudent. As the list of things we know how to solve increases, then we ought to attempt to solve those as well.
> 

Yes, but first we need to make sure we have the open discussions in a congenial manner.  We also need to full understand what is needed by operational security to prevent threat actors and intrusion sets from destroying their networks, users, systems, and data.  

There are many good eco-systems that have very advanced security engineers in them, we should work with them and communicate with them. It would be good for some of us from the IETF to go to these groups and explain what we are working on, why we are working on it, and then ask for feedback from their perspective.  

I believe a document written by the IETF that talks more plainly about the whole security pie, and what parts the IETF is going to try and work on, would be helpful.  We can not boil the ocean.  Further, some parts are better solved outside of the IETF.  We just need to make sure the things we do, do not make other elements of operational security impossible. 

Bret