ietf
[Top] [All Lists]

Re: Review of draft-hartman-webauth-phishing-05

2007-08-21 22:05:12
Your view of the facts are quite at odds with the written record and, more importantly, with RFC 2026.

At 8:34 PM -0400 8/21/07, Sam Hartman wrote:
 >>>>> "Paul" == Paul Hoffman <paul(_dot_)hoffman(_at_)vpnc(_dot_)org> writes:

    >> I do hope that we have consensus these are good requirements,

    Paul> We absolutely do not have any such consensus. There was
    Paul> barely any discussion during IETF Last Call. There was not a
    Paul> mailing list for discussing the draft.

Hmm.  I actually think that as ad-sponsored informationals go this got
a lot of constructive discussion in ietf last call.

Unless I am reading the official archive wrong, you had a few round trips with one person.

It was discussed
on the dix and http-auth lists and at the WAE BOF.

Unless I am reading the archive of those two mailing lists incorrectly, your draft has not been discussed there in over a year. According to the minutes of the WAE BoF a year ago, the draft as it stood at that time was indeed discussed, but the minutes do not say that there was IETF consensus even then.

My perception of
the room at WAE was that with the exception of the requirement about
mutual authentication this was relatively non-controversial and that going forward with such a document would be useful.

That is my interpretation of the minutes as well. And that is irrelevant to saying that there is IETF consensus for the document, given that you have made many changes to the draft in the past year. Also, recently you have found that agreement in the room at a BoF was insufficient reason to move forwards with work,

Now, we may actually be saying the same thing.

I'm quite sure we are not.

I think this document
has received review similar to other IETF informational documents.

We disagree here, at least for all the mailing list traffic that I have seen for your document.

There's a lot of open question about what the status of such documents
is;

OK, we agree here. :-)

absent evidence such as an IESG note I assume such documents have
rough consensus of the IETF.

...but not here.  RFC 2026 says:
   An "Informational" specification is published for the general
   information of the Internet community, and does not represent an
   Internet community consensus or recommendation.
I do not read that as meaning that the IESG needs to put a note in every RFC for which that statement will be true.

Others may not read things that way or
may assume a different level of support behind informational documents
for which we do an IETF last call.

<hand raises>

Ultimately though the issue of adequacy of review rests with Lisa and
the IESG. I'm obviously recused from formal participation in that
process.

If the document is meant to convey IETF consensus, and can be used to block later protocol proposals, the level of review is not nearly as important as the document status. You seem to be describing a BCP.

Paul> Speaking for myself,
    Paul> I didn't comment because I thought it was meant to be an
    Paul> Informational RFC saying what Sam Thinks About These
    Paul> Requirements.

If I wanted to publish such a document I would have gone to the rfc editor.

That's fine, but those of us who might have reviewed the document had no indication that you thought that way (nor that you thought that this document, with the scant discussion, had the weight of IETF consensus.


    Paul> The IETF Last Call announcement said *nothing*
    Paul> suggesting that this was a consensus call.
I thought all IETF last calls are consensus calls.

RFC 2026 is pretty clear on this:
   An "Informational" specification is published for the general
   information of the Internet community, and does not represent an
   Internet community consensus or recommendation.

    Paul> It is inappropriate to change the intended use of this
    Paul> document after IETF Last Call.

Here we agree.  I'm not asking for treatment any different than any
other AD-sponsored informational document.

Here we disagree. Your statements in the past few messages were asking for a status (IETF consensus) that is not granted to other Informational RFCs, and were saying that such status allows blockage of future documents until a review was done against this one.

--Paul Hoffman, Director
--VPN Consortium

_______________________________________________
Ietf mailing list
Ietf(_at_)ietf(_dot_)org
https://www1.ietf.org/mailman/listinfo/ietf