Subject: Re: [GNAP] Concerns with the lack of progression of GNAP after 20 months of work

From: Fabien Imbault <[email-masked]>
Date: Tue, 1 Mar 2022 13:48:42 +0100

Dear Denis,

Sorry I have to say this, but repeating your misconceptions don't make them
true. That's currently not helping anyone going forward.

The editors and chairs welcome anyone with helpful contribution.
Already the spec had many great improvements, from many outstanding
individuals cited in the text. Including on security and privacy.

We are now stabilizing the core draft and focusing on real world
implementations to demonstrate the value and interoperability.

Best regards,
Fabien (speaking only in my own name)

On Tue, 1 Mar 2022, 12:49 Denis, <[email-masked]> wrote:

> Hello everybody,
>
> GNAP has four main components : users, clients, ASs and RSs.
>
> GNAP is supposed to describe a protocol. A protocol is a set of rules
> that control the way data is exchanged between computers.
> A reader would expect to find the description of the data sent by a client
> to a RS (which are indeed described in ietf-wg-gnap/core-protocol),
> but also find how that data *shall be handled by a RS* which is supposed
> to be described in draft-ietf-gnap-resource-servers. Unfortunately,
> this is not the case.
>
> The focus has been placed on the "core" protocol, leaving aside the the RS.
>
> The core document (ietf-wg-gnap/core-protocol) has now got more than 400
> issues !
>
> Besides the editors (and the chair), very few members are active and at
> this time it is unlikely that more members will participate
> since *the main driving line for the construction of GNAP has been los**t*
> .
>
> The recent message called "embedding GNAP" got no reply from the WG,
> except one from a co-editor.
> IMO, this demonstrates that *GNAP is still a **moving target* *after 20
> months of work.*
>
> Does this mean that all the WG members agree with the very few emails that
> are exchanged or that the WG members are
> no longer really able to participate to the discussion since such
> participation would involve a lot of days to get "up to speed" again ?
> I would guess that the right answer is the latter.
>
> The core document has still *no security model *and hence its security is
> more than questionable.
>
> The core document is AS centric and hence *the **privacy concerns of the
> users cannot be addressed*. Is this deliberate ?
> When the work started, privacy was supposed to be a major concern to be
> taken into consideration, but in practice, this is not the case.
>
> The core document still does not address the general use case.
>
> There are so many options that *interoperability will not be possible*.
>
> *draft-ietf-gnap-resource-servers-01** expired on 13 January 2022*.  We
> are now close to an IETF meeting and no draft is available.
> The milestones are outdated and, anyway, are not observed (see
> https://datatracker.ietf.org/doc/charter-ietf-gnap/writeup/)
>
> Milestones:
>
>   Jul 2021 - Core delegation protocol in WGLC
>
>   Oct 2021 - Key presentation mechanism binding to the core protocol, TLS, to WGLC
>
>   Oct 2021 - Key presentation mechanism binding to the core protocol, detached HTTP signatures, to WGLC
>
>   Oct 2021 - Key presentation mechanism binding to the core protocol, embedded HTTP signature, to WGLC
>
>   Dec 2021 - Guidelines for use of protocol extension points to WGLC
>
>   Feb 2022 - Guidelines on migration paths, implementation, and operations to WGLC
>
>
> At the next IETF meeting, rather than addressing, *as usual,* the last
> technical issues that no one or very few people will be able to follow or
> understand,
> I would suggest that the editors address the following topics:
> *interoperability*, *privacy *and *security *at a level that will allow
> everybody to understand
> the real issues behind these three words and by presenting *a balanced
> view*.
> Denis
>
> PS: If we were working within ISO, this WG would already have been closed.
>
> --
> TXAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/txauth
>