Re: [Tzdist] AD review of draft-ietf-tzdist-service-07 - Sections 8

That is essentially my feeling.

  It's good to make implementors aware of these issues - there probably 
isn't sufficient awareness in general.

What we choose to do about it is another issue - but at least we've been 
told.

On 05/12/2015 02:11 PM, Daniel Migault wrote:
> Hi,
>
> I believe there is a consensus that there are privacy issues, and that they should be documented. Whether they will be followed or ignored is another thing. I find it better to ignore while understanding their implications.
>
> My interpretation is that some of the issues have been raised by the WG, but we got a significant among of comments from the saag review. My understanding is that the WG agreed on the raised issues. I believe it is good these issues are being raised in order to document potential issues and information leakage. How the recommendations should be followed depends on the level of privacy that clients or servers want to implement and may be balanced with additional aspects.
>
> BR
> Daniel
>
> -----Original Message-----
> From: Tzdist [mailto:tzdist-bounces@ietf.org] On Behalf Of Barry Leiba
> Sent: Tuesday, May 12, 2015 1:15 PM
> To: Cyrus Daboo
> Cc: tzdist@ietf.org; draft-ietf-tzdist-service@ietf.org
> Subject: Re: [Tzdist] AD review of draft-ietf-tzdist-service-07 - Sections 8 - 10
>
> Another batch we're almost set on.  I just want to ask one further question about the insanely over-paranoid privacy stuff (yes, you can infer my view on this, you can...).
>
>> There was a thorough security/privacy review by Daniel Kahn Gillmor
>> that lead to the current text in Section 9 (see tzdist mailing
>> messages with "[saag]" in the subject).
> ...
>> Anyway, I am not sure, beyond some small clarifications, if anything
>> needs to change in this section. Certainly it needs input from
>> SAAG/Security ADs if we do decide to make changes now. Perhaps this
>> should be left to an IETF wide review (with another call to SAAG folks to pay attention to it)?
> I don't have time right now to read the email thread (about to leave for vacation until Sunday, back to work on Monday), but I'd like to know one thing here: Does the tzdist working group have real consensus on all this?  Or did it merely agree to what's there in order to get acceptance from the saag folks?
>
> Barry
>
> _______________________________________________
> Tzdist mailing list
> Tzdist@ietf.org
> https://www.ietf.org/mailman/listinfo/tzdist
>
> _______________________________________________
> Tzdist mailing list
> Tzdist@ietf.org
> https://www.ietf.org/mailman/listinfo/tzdist