Re: [TLS] simplistic renego protection

[Chris Newman <[e-mail]>]

--On November 16, 2009 18:25:32 +0100 Martin Rex <[e-mail]> wrote:
> But when a proposal enters the IETF process, the IETF and the
> working group should discuss it based on its technical merits.

The IETF is about rough consensus and running code.  Technical merit is one 
aspect of that.  Time to market can be important.  Technical maturity of 
the specification can be important.  The best or perfect proposal often 
takes longer to develop than the good enough proposal and thus loses.  Just 
look at how badly HTTP is designed when it comes to authentication -- but 
it was good enough to standardize.  The HTTP Next-Generation working group 
failed because HTTP is good enough.

draft-rescorla-tls-renegotiation-00 already has lots of running code; and 
that's a traditional IETF litmus test that correctly makes alternative 
proposals far less attractive.

If you want your alternative proposal to be considered, submit an Internet 
draft and get some running code and feedback from implementations showing 
your proposal would deploy protection to more users than 
draft-rescorla-tls-renegotiation-00.  Then you may sway people to your 
viewpoint.

But time-to-market is __very__ important for this particular problem.  I 
think you have already spent too much time arguing on the list and not 
enough time writing specs and gathering implementation experience to make a 
viable alternative proposal.

		- Chris