[GNAP] Concerns with the lack of progression of GNAP after 20 months of work

[Denis <[e-mail]>]

Hello everybody,

GNAP has four main components : users, clients, ASs and RSs.

GNAP is supposed to describe a protocol. A protocol is a set of rules 
that control the way data is exchanged between computers.
A reader would expect to find the description of the data sent by a 
client to a RS (which are indeed described in ietf-wg-gnap/core-protocol),
but also find how that data *shall be handled by a RS* which is supposed 
to be described in draft-ietf-gnap-resource-servers. Unfortunately,
this is not the case.

The focus has been placed on the "core" protocol, leaving aside the the RS.

The core document (ietf-wg-gnap/core-protocol) has now got more than 400 
issues !

Besides the editors (and the chair), very few members are active and at 
this time it is unlikely that more members will participate
since *the main driving line for the construction of GNAP has been los**t*.

The recent message called "embedding GNAP" got no reply from the WG, 
except one from a co-editor.
IMO, this demonstrates that *GNAP is still a **moving target* *after 20 
months of work.*

Does this mean that all the WG members agree with the very few emails 
that are exchanged or that the WG members are
no longer really able to participate to the discussion since such 
participation would involve a lot of days to get "up to speed" again ?
I would guess that the right answer is the latter.

The core document has still *no security model *and hence its security 
is more than questionable.

The core document is AS centric and hence *the **privacy concerns of the 
users cannot be addressed*. Is this deliberate ?
When the work started, privacy was supposed to be a major concern to be 
taken into consideration, but in practice, this is not the case.

The core document still does not address the general use case.

There are so many options that *interoperability will not be possible*.

*draft-ietf-gnap-resource-servers-01**expired on 13 January 2022*.  We 
are now close to an IETF meeting and no draft is available.

The milestones are outdated and, anyway, are not observed 
(seehttps://datatracker.ietf.org/doc/charter-ietf-gnap/writeup/)

Milestones:

   Jul 2021 - Core delegation protocol in WGLC

   Oct 2021 - Key presentation mechanism binding to the core protocol, TLS, to WGLC

   Oct 2021 - Key presentation mechanism binding to the core protocol, detached HTTP signatures, to WGLC

   Oct 2021 - Key presentation mechanism binding to the core protocol, embedded HTTP signature, to WGLC

   Dec 2021 - Guidelines for use of protocol extension points to WGLC

   Feb 2022 - Guidelines on migration paths, implementation, and operations to WGLC

At the next IETF meeting, rather than addressing, /as usual,/ the last 
technical issues that no one or very few people will be able to follow 
or understand,
I would suggest that the editors address the following topics: 
*interoperability*, *privacy *and *security *at a level that will allow 
everybody to understand
the real issues behind these three words and by presenting *a balanced 
view*.

Denis

PS: If we were working within ISO, this WG would already have been closed.