Re: [TLS] OpSec WGLC for draft-ietf-opsec-ns-impact

[Nick Lamb <[e-mail]>]

Hi Nancy

On Mon, 26 Oct 2020 02:55:52 +0000
"Nancy Cam-Winget (ncamwing)" <[e-mail]> wrote:

> [NCW] The specific conditions are more deployment and vendor specific
> and proprietary so it'd be difficult to enumerate (and enumerate them
> all)...as well as which we believe is out of scope for the document.
> I did add a paragraph to state that as well as we (the authors) are
> not proponents for these techniques but as it had been asked to how
> the deployments 'inspect' we thought it important to document the
> most common known practices.  Please look over the updates and see if
> that clarifies intent.

I see. I focused on the modifications to the document rather than
re-reading the document. Thanks for correcting the typographical error
and I acknowledge that the two new paragraphs reflect the intent
you've described.

> [NCW] Right, our intent was not to prescribe what should or should
> not be done, but rather educate as to what is being done in practice
> today.

Unfortunately words like "effective" and "capability" give the
impression that instead of describing practices which don't work
neutrally so as to educate about what is done, this documents
techniques that actually worked. My previous emails explained some
problems with that back in August.

Your co-author Roelof has argued that they can work under some specific
circumstances, but this revision does not explain what those
circumstances would be in the document itself and my impression from
your reply is that you believe doing so would be "out of scope".

Nick.