Re: [GNAP] Design team

[Fabien Imbault <[e-mail]>]

Hi there,

+1 for adopting v14 as a basis for the GNAP WG.

I think really important to have one single document to get everyone
started, and not be stuck on a xyz vs xauth comparison. Instead we now have
a relatively consistent starting point, which is neither xyz nor xauth, for
everyone to step in.

The draft is still inspired by xyz at its core, but a lot of work has been
put into taking the concerns raised in xauth (Dick did raise many issues
into the original document, and made a great job), and others. As anyone
will be able to see into the change logs.

What's important is that editorial notes provide a good summary of the
design choices we need to make.
I can anticipate that some of you will raise other items discussed on the
mailing list, such as privacy for instance. There was consensus on the fact
that it needs to be one of the goals (amongst others) but our core focus
during the work carried out in the small group was to focus on dissenting
opinions about what the starting document should contain. It's not meant to
be perfect (yeah, goal achieved :-)).

I can attest Justin put a lot of hard work in taking into account the
feedbacks and criticisms, and it's quite impressive to still have a fairly
consistent document after so many changes in a short period of time.

Of course neither of us had all of its wishes come true :-) Dick probably
feels some issues he raised are not fully incorporated, because some are
fundamentally different design choices. Again Dick raised very useful
items, some of which made it through, others are only integrated as notes.
At times the tension was palpable and sometimes Kathleen had to remind
everyone to cool down (thanks for that!). And we see some of that into
Dick's request today. I regret a bit that this might hinder the positive
outcome of the work.

All items were on the table. We made a fairly thorough comparison of the
approaches, which led to many parts being rewritten. Justin was quite clear
when he disagreed (it's explicit in the notes) but still captured with
integrity the essence of the tradeoffs, with an open mind.

Of course there's a specific power in holding the pen. I think Justin is
aware of what the role implies. Of course it's sometimes hard to not be too
opinionated, while still being able to say no when required.

Probably the chairs could step in to clarify escalation rules to avoid the
risk mentioned by Dick, in case it ever materializes. No one is perfect.
But so far, Justin's mandate has not transformed into a benevolent
dictatorship, but more a balanced guardianship. As such he keeps my
continued support into the editor's role.

Cheers
Fabien


Le sam. 10 oct. 2020 à 02:26, Dick Hardt <[e-mail]> a écrit :

> Tl;dr: Given where we are in the WG, I am not opposed to the WG adopting
> -14, but I propose someone other than Justin be the document editor.
>
> I was on the design team to work on the goals set out by the chairs [1]:
>
> "We expect the design team to decide on a solution outline that combines
> the best of both proposals, and present this outline by Sep. 15"
>
> Surprisingly, Kathleen convened the design team with her recommendation to
> start with the XYZ document with Justin as editor, and add in the diagrams
> from XAuth. The rest of the design team had an opportunity to express their
> concerns and Justin edited the document. In other words, I had to convince
> Justin to change the document, rather than the design team comparing and
> contrasting the proposals and selecting the best parts. I expressed my
> concerns with our AD, and decided to continue participating in the design
> team. We did make some progress on a number of issues thanks to the hard
> work of Fabien, Justin, and Mike -- but many issues have been punted to the
> WG.
>
> Justin has poured tons of energy into this project, and to his credit he
> was a good editor at times, but there are areas where he was unwilling to
> deviate from his vision.
>
> I am concerned about a repeat of what happened in OAuth 2.0: Erin had the
> pen and had strong views that often were not aligned with the rest of the
> WG. A good example was Erin's distaste for bearer tokens. He factored that
> out of the core document, which we are now adding back in with OAuth 2.1.
> Anyone that participated in the WG saw the issues this had.
>
> I'm not suggesting that Justin is Erin, but I think a more neutral editor
> of the core document will allow us to make progress more quickly.
>
> /Dick
>
> [1]
> https://mailarchive.ietf.org/arch/msg/txauth/By7tDkJBxhmHbP7vKwubC9eW38I/
> ᐧ
>
> On Fri, Oct 9, 2020 at 5:04 PM Justin Richer <[e-mail]> wrote:
>
>> Thanks, Kathleen, and thanks to Dick, Mike, and Fabian for all their hard
>> work and discussion as well. This draft contains aspects of XYZ and Xauth,
>> and introduces some new elements and pieces as well. As you'll see, there
>> are many identified issues and decisions to be made, but even then I
>> believe it hangs together fairly cohesively already thanks to the good
>> engineering effort and discussion that's gone in so far.
>>
>> Nothing in the document is final, of course. To me, this document
>> represents a good starting point for working group discussion and
>> decisions, +1 for its adoption.
>>
>> - Justin
>> ________________________________________
>> From: TXAuth [[e-mail]] on behalf of Kathleen Moriarty [
>> [e-mail]]
>> Sent: Friday, October 9, 2020 6:55 PM
>> To: [e-mail]
>> Subject: [GNAP] Design team
>>
>> Greetings!
>>
>> The design team has now come to a close.  While there were too many
>> issues to resolve to all design team member satisfaction, great effort was
>> put in to describe decision points for the WG to ease and hopefully speed
>> the working group process.  As such, I am requesting that the WG adopts
>> this version (14 of XYZ) and works together to fully develop a single
>> specification.
>>
>> https://datatracker.ietf.org/doc/draft-richer-transactional-authz/
>>
>> A tremendous thank you to each of the design team members for your hard
>> work and walking the fine line of when to put a stake in the ground (that
>> the WG can always change once adopted) and listing our options for decision
>> points to ease the WG process.
>>
>> Best regards,
>> Kathleen
>>
>> Sent from my mobile device
>>
>> --
>> TXAuth mailing list
>> [e-mail]
>> https://www.ietf.org/mailman/listinfo/txauth
>>
> --
> TXAuth mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/txauth
>