ietf
[Top] [All Lists]

Re: Review of draft-hartman-webauth-phishing-05

2007-08-22 09:21:30


--On Wednesday, 22 August, 2007 10:40 -0400 Sam Hartman
<hartmans-ietf(_at_)mit(_dot_)edu> wrote:

"Henning" == Henning Schulzrinne <hgs(_at_)cs(_dot_)columbia(_dot_)edu>
writes:

    Henning> Rather than an IESG note or in addition to, I
think the     Henning> author should clearly state, in the
abstract, that this     Henning> is a personal opinion only.

I don't think my personal opinion would make a very useful
document, but if that's all we can come away from this process
with then that's all we will achieve.


First, I'd rather try and build consensus and get more review.

Failing that, I think we could come up with a way of
describing the status of this document that does not give the
impression that it has even less review than other documents
that are of the same status. I.E. I think it would be an
unfortunate outcome if we feel the need to add a bunch of
warnings in this case simply because we've had a discussion
and realized that we don't entirely agree on what our
documents mean.

Sam,

It is the question of how to accurately reflect the amount of
review and/or agreement that has caused me to be so concerned
about the apparently-rigid language in RFC 3932 and
interpretations of that language that make it even more rigid.

Some informational documents are better reviewed than others.
Some represent consensus about the right things to do, others
don't.  Some of those that do not represent a consensus about
what to do still represent consensus that the document a
reasonable and comprehensive description of a situation and
possibly the range of known solutions.   Any of these may be
useful (or not).   Which category a document falls into is
largely independent of whether a document goes through the IESG
track or the RFC Editor one.

IMO, the thing we need to be careful about is assertions about
IETF consensus or IETF review: If such consensus exists and has
been formally verified, or such a review actually took place and
was meaningful, it is reasonable to say that.  But the absence
of formal review or verification doesn't imply "bad" or
"dangerous" or "incompetent", it just implies that one
particular review and approval process didn't take place.

Maybe, instead of having arguments about consensus,
recommendations, and whether or not things are going to be taken
to be normative, it is time we permit --and perhaps require--
authors of Informational documents to insert a statement that
accurately describes one or both of (i) levels of review and
consensus and (ii) intended use.  It would then be a key element
of whatever review process is used to verify that such
statements are accurate.

Taking this document as an example, it would seem reasonable to
me to say "This has been discussed around the IETF and
elsewhere.  While some people agree with it, others do not and
some of the others believe it is premature with regard to both
the developing state of the art and it literature review and
citations.  It is the intention of the author that the document
be used to inform the ongoing debate and discussion, not that it
be considered normative or a constraint on future work in the
IETF or in other forums".  

If I am correct that a statement of that type accurately
represents your view and that of others who support the content
of the document, EKR's view, and reality, we would then be
finished.
 
I think making it clear that this is not normative is quite
important.

Obviously.  But it is only part of the problem and solution, IMO.

    john


_______________________________________________
Ietf mailing list
Ietf(_at_)ietf(_dot_)org
https://www1.ietf.org/mailman/listinfo/ietf