Re: [TLS] simplistic renego protection

[Martin Rex <[e-mail]>]

OK.  I'm going to write an I-D.

I've not done this before -- it'll take me at least one day.

In my previous IETF participation, document authors were always
quite open minded to improvements, so I never had to actually
write a counterproposal.


-Martin

Chris Newman wrote:
> 
> --On November 16, 2009 18:25:32 +0100 Martin Rex <[e-mail]> wrote:
> > But when a proposal enters the IETF process, the IETF and the
> > working group should discuss it based on its technical merits.
> 
> The IETF is about rough consensus and running code.  Technical merit is one 
> aspect of that.  Time to market can be important.  Technical maturity of 
> the specification can be important.  The best or perfect proposal often 
> takes longer to develop than the good enough proposal and thus loses.  Just 
> look at how badly HTTP is designed when it comes to authentication -- but 
> it was good enough to standardize.  The HTTP Next-Generation working group 
> failed because HTTP is good enough.
> 
> draft-rescorla-tls-renegotiation-00 already has lots of running code; and 
> that's a traditional IETF litmus test that correctly makes alternative 
> proposals far less attractive.
> 
> If you want your alternative proposal to be considered, submit an Internet 
> draft and get some running code and feedback from implementations showing 
> your proposal would deploy protection to more users than 
> draft-rescorla-tls-renegotiation-00.  Then you may sway people to your 
> viewpoint.
> 
> But time-to-market is __very__ important for this particular problem.  I 
> think you have already spent too much time arguing on the list and not 
> enough time writing specs and gathering implementation experience to make a 
> viable alternative proposal.
> 
> 		- Chris
> 
>