Subject: Re: Next step on web phishing draft (draft-hartman-webauth-phishing-05.txt)

From: Eliot Lear <[email-masked]>
Date: Mon, 10 Sep 2007 08:59:57 +0200

Bernard,

> I agree with EKR here.  Failed consensus is failed consensus.  RFC 2026 
> does not support the process that has been recommended here. 
>
>   

Perhaps Sam and Lisa can explain a bit more as to what process they 
intend to use.  It seems that Alexey is providing a forum for discussion 
to improve the document, and I see nothing wrong with that.  I would 
imagine that both the IESG and the community will still get their say, 
so what precisely is the problem?

This having been said, it seems to me that in order to address EKR's 
(and perhaps others') concerns, the document will need substantial 
work.  I welcome efforts to improve that work.  Where should that 
happen?  Must Sam do it alone?

Eliot

_______________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf

---

From: Alexey Melnikov <[email-masked]>
Date: Mon, 10 Sep 2007 11:17:08 +0100

Eliot Lear wrote:

> Bernard,
>
>> I agree with EKR here.  Failed consensus is failed consensus.  RFC 
>> 2026 does not support the process that has been recommended here.   
>
> intend to use.  It seems that Alexey is providing a forum for 
> discussion to improve the document, and I see nothing wrong with that.

Indeed, that is exactly what I was trying to say.

Lisa and Sam suggested to use [email-masked] and I 
thought it made sense.

> I would imagine that both the IESG and the community will still get 
> their say, so what precisely is the problem?

Exactly. It is not like [email-masked] is a closed 
moderated mailing list.

> happen?  Must Sam do it alone?

If people can suggest a better place for work on this document, please 
speak up now.

---

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Mon, 10 Sep 2007 06:20:46 -0700

> [mailto:[email-masked]] On Behalf 
> Of Eliot Lear

> Perhaps Sam and Lisa can explain a bit more as to what 
> process they intend to use.  It seems that Alexey is 
> providing a forum for discussion to improve the document, and 
> I see nothing wrong with that.  I would imagine that both the 
> IESG and the community will still get their say, so what 
> precisely is the problem?
> 
> This having been said, it seems to me that in order to 
> address EKR's (and perhaps others') concerns, the document 
> will need substantial work.  I welcome efforts to improve 
> that work.  Where should that happen?  Must Sam do it alone?

Its an architecture issue. It is the type of issue that I would like to see the IAB take up in combination with the other principal stakeholders here - the banks, the ISPs.

We do have some resources to draw on here, the Anti-Phishing Working Group and FSTC.

---

From: Eric Rescorla <[email-masked]>
Date: Mon, 10 Sep 2007 07:04:57 -0700

At Mon, 10 Sep 2007 08:59:57 +0200,
> happen?  Must Sam do it alone?

Sam can of course consult anyone who he chooses for opinions,
reviews, etc. However, Alexey's original message indicated
something rather different. Namely:

	Subsequent discussions and consensus calls on the document
	would happen on <[email-masked]>.

	...

	Alexey,
	in my capacity of shepherd for draft-hartman-webauth-phishing

This document isn't a WG document and this mailing list is not a WG
list. It's inappropriate to hold any kind of "consensus calls".
Moreover, as there's no WG, Alexey isn't the chair and doesn't
have any authority to run a consensus or any other process. 

This document was taken to the IESG and didn't achieve consensus
in LC. It now has the same status as any other random individual
ID, nothing more nothing less.

-Ekr

---

From: "Dan Schutzer" <[email-masked]>
Date: Mon, 10 Sep 2007 10:24:20 -0400

I agree with Phillips comments and the FSTC stands ready to help

-----Original Message-----
From: Hallam-Baker, Phillip [mailto:[email-masked]] 
Sent: Monday, September 10, 2007 9:21 AM
To: Eliot Lear; IETF Discussion; [email-masked]
Subject: RE: [Ietf-http-auth] Re: Next step on web
phishingdraft(draft-hartman-webauth-phishing-05.txt)

> that work.  Where should that happen?  Must Sam do it alone?

Its an architecture issue. It is the type of issue that I would like to see
the IAB take up in combination with the other principal stakeholders here -
the banks, the ISPs.

We do have some resources to draw on here, the Anti-Phishing Working Group
and FSTC.

---

From: Alexey Melnikov <[email-masked]>
Date: Mon, 10 Sep 2007 18:21:36 +0100

Eric,

>	in my capacity of shepherd for draft-hartman-webauth-phishing
On rereading my message, it probably came out stronger than I intended.
But according to my English-Russian dictionary the verb "would" can 
convey "polite request", which was my intent.

>have any authority to run a consensus or any other process.
I think you are reading too much into my message.
I didn't say that I will run any consensus calls, shepherding AD has the 
authority to do that.
And you are correct of course that I don't have any authority in this 
case. I am just working for the shepherding AD, trying to help her in 
getting the document through IESG.

>ID, nothing more nothing less.
Yes (the last sentence).

It is not yet clear to me if you have any problems with the document 
being discussed on http-auth mailing list. If you have, can you explain 
why and maybe suggest a better place for discussions?

And if you would like to suggest a better process for moving things 
forward, please share your opinion.

Regards,
Alexey

---

From: Eric Rescorla <[email-masked]>
Date: Mon, 10 Sep 2007 11:29:46 -0700

At Mon, 10 Sep 2007 18:21:36 +0100,
> convey "polite request", which was my intent.

Hmm... I'm still not sure what you're trying to say. My point is
that there shouldn't be any consensus calls by anyone on the
ietf-http-auth mailing list. It's not a WG.

> forward, please share your opinion.

I have no problem with Sam soliciting opinions in his document on any
forum of his choice. What I object to is the notion--again implied in
your above comments--that this document has some formal standing.  As
I said initially, this is an individual submission that failed to
obtain consensus. As such it doesn't need shepherding or shepherding
ADs, any more than any other individual ID.

> forward, please share your opinion.

As should be clear from my initial review, I don't think this document
should move forward.

If the author feels differently, he is of course free to revise the
document, try to build consensus, and resubmit to the IESG at some
point in the future. Since it's an individual submission, no IETF
process is needed or appropriate for that.

-Ekr

---

From: Jeffrey Altman <[email-masked]>
Date: Mon, 10 Sep 2007 14:45:26 -0400

> ietf-http-auth mailing list. It's not a WG.

Eric:

It sounds to me as if you are attempting to claim that only official
IETF activities are permitted to ask the participants in a discussion
what they think.

Clearly it is not going to be possible for a subsequent revision of
this document to be re-submitted to the IESG if the contributors to
the document cannot achieve consensus among themselves.

> ADs, any more than any other individual ID.

This is a document for which an Area Director (separate from the one
who happened to be the author of the document) wishes to forward
progress.  While this does not imply a formal basis for consideration,
it does provide incentive to put additional effort into revising it.

Alexey was asked by an AD to take responsibility for this document.
He is trying to fulfill that request.  There is no reason to put
hurdles in his path.

> As should be clear from my initial review, I don't think this document

That is your opinion and you are welcome to hold it.

However, it is clear to me that this problem area cannot be addressed by
organizations such as W3C without the support and collaboration
of the IETF.

Jeffrey Altman

---

From: Nicolas Williams <[email-masked]>
Date: Mon, 10 Sep 2007 13:52:00 -0500

> ietf-http-auth mailing list. It's not a WG.

Are you saying that a design team can't have "consensus" or "consensus
calls"?  Surely they can, though consensus internal to design teams
cannot, and, indeed, must not be binding on any other aspect of IETF
processes.

So my question is: is the ietf-http-auth mailing list intended to act as
a forum for a design team working on draft-hartman-webauth-phishing?

If so then I don't understand your objection.  Let the design team do
what they will, and if and when they have something to show then we can
have another IETF LC (or BoF).  Or are you saying that the IETF LC that
has already taken place failed in a permanent way, as opposed to finding
issues that need work but which do not prevent the document from being
brought forward again?  I.e., did the IETF LC on this I-D really fail
with prejudice?  And if so, who determined that?

> ADs, any more than any other individual ID.

Speaking of consensus on a non-WG/IETF list != formal standing; I doubt
anyone here would argue that it does.

But this draft does have a formal _state_: "IESG Evaluation :: Revised
ID Needed."

What you say implies that design teams can't have consensus.  Surely you
don't actually believe that.

> As should be clear from my initial review, I don't think this document

In its current form?  Or in its approach to the problem?  Is there a
process by which the IESG or IETF can actually reject an idea or
document _with prejudice_?

> process is needed or appropriate for that.

I think that's exactly what's happening.

Nico
--

---

From: Eric Rescorla <[email-masked]>
Date: Mon, 10 Sep 2007 11:51:07 -0700

At Mon, 10 Sep 2007 14:45:26 -0400,
> IETF activities are permitted to ask the participants in a discussion

Not at all. There is a huge difference between "ask participants
in a discussion what they think" and a "consensus call". 

> the document cannot achieve consensus among themselves.

But this list is not the list of contributors to this document.
It's some other list, one with no formal standing for any sort
of "consensus call." 

> Alexey was asked by an AD to take responsibility for this document.

Yes, and my point is that I don't believe that's an appropriate
procedure. Individual submissions are just that. Given that this one
has already failed to achieve consensus in a previous IETF LC, if the
AD wants to actively progress this document--as opposed to just
passively waiting for some forthcoming revision--then the appropriate
next step is a BOF followed by a WG.

> organizations such as W3C without the support and collaboration

It may be clear to you, but it certainly hasn't been established
in any way I find convincing.

In any case, this isn't "the IETF". It's an individual
submission. "The IETF" would be a WG, IESG statement, etc.

-Ekr

---

From: Nicolas Williams <[email-masked]>
Date: Mon, 10 Sep 2007 14:25:49 -0500

> But this draft does have a formal _state_: "IESG Evaluation :: Revised

It's state seems to be that it has not exactly failed IETF LC (e.g., one
IESG member commented that "[i]t is my educated guess there is rough
consensus in the IETF to publish this document.  However, additional
work to document that roughconsensus would be helpful given the strength
of the two last call objections."  Which proves nothing, except that the
process is such that the sponsoring AD and the IESG as a whole are
responsible for calling the result of the IETF LC and for insisting on
whatever changes are needed for IETF LC comments to be addressed that
have to be addressed.  Once the IESG makes a decision one can appeal.

Nico
--

---

From: Dave Cridland <[email-masked]>
Date: Mon, 10 Sep 2007 20:27:54 +0100

> in a discussion what they think" and a "consensus call". 
Not really a huge difference. One is asking them what they think, the  
other is, well, asking them whether they all think approximately the  
same thing. I think you're suggesting that a consensus call on a  
non-IETF mailing list, albeit one whose participants are recruited  
from within the IETF participants, should not carry weight within the  
IETF.

That's true in theory, and I agree with it as a simple statement, but  
of course when those self-same participants then report that  
consensus to the IETF, then it becomes a consensus view held by a  
number of interested IETF participants, which has very strong  
consideration when calling IETF consensus as a whole.

But, as you imply, an "IETF consensus call" *is* a huge difference,  
since that implies it is the consensus of the IETF, whereas I don't  
think anyone's claiming that it would be - perhaps it's an  
unfortunate wording choice on Alexey's part that's left you with this  
idea.

In any case, such consensus calls as Alexey could make on a non-IETF  
mailing list concerning an individual document would merely act as a  
useful guide to the author on how to build consensus within the IETF.

> It's some other list, one with no formal standing for any sort
No formal standing within the IETF, no.

If you want Alexey to pick a different phrase than "consensus call",  
go for it. It'll mean the same thing, but without the connotations.  
Shall we say "shared opinion call"?

> next step is a BOF followed by a WG.

So you also want a different word to "shepherding"?

Might I suggest "swineherding"? I'll enjoy calling Alexey a  
"swineherd". (Is he allowed to ask for oinks to get a sense of the  
room?)

If you're saying you think there ought to be a BOF, that's a  
statement of opinion I can certainly sympathize with, although in  
this case I think that would merely act as a way of losing momentum.  
I don't see why you assert that a BOF->WG path is the only option,  
though.

Dave.
-- 
Dave Cridland - mailto:[email-masked] - xmpp:[email-masked]
  - acap://acap.dave.cridland.net/byowner/user/dwd/bookmarks/
  - http://dave.cridland.net/
Infotrope Polymer - ACAP, IMAP, ESMTP, and Lemonade

---

From: Eric Rescorla <[email-masked]>
Date: Mon, 10 Sep 2007 11:56:15 -0700

At Mon, 10 Sep 2007 13:52:00 -0500,
> cannot, and, indeed, must not be binding on any other aspect of IETF

Indeed. And so when the "document shepherd" implies that he or the
AD will be issuing consensus calls, I think that implies something
quite different from some internal design team consensus call.

> a forum for a design team working on draft-hartman-webauth-phishing?

Good question. Let's ask the author of the document, who is the only
person who can speak to the future direction of an individual
submission. Sam?

> I think that's exactly what's happening.

That's not what I see, unless Alexey suddenly became the author of
the document. Rather, I see someone claiming to be the document
shepherd acting under the direction of the AD talking about the
way forward. How is that the author revising the document, trying
to build consensus, etc.?

-Ekr

---

From: Nicolas Williams <[email-masked]>
Date: Mon, 10 Sep 2007 14:42:56 -0500

> quite different from some internal design team consensus call.

I don't see the implication.

> person who can speak to the future direction of an individual

Actually, looking at the I-D's state and the IESG evaluation record I
see that it is not clear that the document either passed or failed IETF
LC, and that it might yet be approved.

> to build consensus, etc.?

Why on Earth couldn't Sam let Alexey run a design team to come up with
improvements that Sam could make to the I-D?

Of course, we've not heard from Sam on this (or if we have, I've missed
it -- I don't subscribe to the main ietf list).

Nico
--

---

From: "Larry Masinter" <[email-masked]>
Date: Mon, 10 Sep 2007 12:55:46 -0700

> in a discussion what they think" and a "consensus call".

I've frequently seen postings that talk about the "consensus"
of a Bar BoF, and never seen any objection to that terminology.
Consensus is always qualified by the scope of the participants,
and we all know how to tell the difference between "consensus
of the IETF", "consensus of the room", "consensus of the working
group", and "consensus of the participants in the mailing list X".

I think the process discussion is a distraction from working
on the actual issues, and wish it would stop.

Larry
-- 
http://larry.masinter.net

---

From: Keith Moore <[email-masked]>
Date: Mon, 10 Sep 2007 15:59:02 -0400

> ietf-http-auth mailing list. It's not a WG.
I think I'd say it slightly differently.  I don't see why any discussion
group shouldn't try to reach consensus within that group.  But such
consensus doesn't impose any burden on IETF to adopt its output. 

Then again, neither (IMHO) does consensus of an IETF WG impose any
burden on IETF as a whole to adopt its output.  Every working group (and
every individual submitter) should understand that it's its job to earn
community-wide consensus, rather than merely consensus within its group.

---

From: Eric Rescorla <[email-masked]>
Date: Mon, 10 Sep 2007 12:56:54 -0700

At Mon, 10 Sep 2007 20:27:54 +0100,
> So you also want a different word to "shepherding"?

No. I want there not to be an implication that the development
of this document is a formal activity of the IETF.

> I don't see why you assert that a BOF->WG path is the only option,  

I didn't say that.

Either this is an individual submission, in which case it has no
formal standing and the only time the AD should be intervening
is when pub is requested, or it's not an individual submission,
in which case the correct process is for it to go through a WG.
What I'm objecting to is what appears to be the AD-sponsored
formation of some design team which has not gone through
the BOF->WG process.

-Ekr

---

From: Ned Freed <[email-masked]>
Date: Mon, 10 Sep 2007 14:48:56 -0700 (PDT)

> on the actual issues, and wish it would stop.

+1

				Ned

P.S. For the record, I think this document needs a bit of revising but
if that's done sensibly I fully support its publication.

---

From: <[email-masked]>
Date: Mon, 10 Sep 2007 23:46:52 +0100

> Hmm... I'm still not sure what you're trying to say. My point 
> is that there shouldn't be any consensus calls by anyone on 
> the ietf-http-auth mailing list. 

Why not? Does the IETF have a patent on IETF processes?

> It's not a WG.

Why not?

Of course, you probably mean that any consensus calls on the
ietf-http-auth mailing list would not be considered IETF consensus calls
because that list is not formally an IETF WG and is not formally
following all IETF processes.

In any case, a WG is not supposed to be formed unless there is already
some work done and that work has reached some consensus among interested
parties. One would expect that people working on a draft would try to
use some of the IETF process in order to get to the point of either
publishing a draft or forming a WG.

Unless of course, the IETF has some exclusive intellectual rights in
running WGs and having consensus calls...

> I have no problem with Sam soliciting opinions in his 
> document on any forum of his choice. What I object to is the 
> notion--again implied in your above comments--that this 
> document has some formal standing.  As I said initially, this 
> is an individual submission that failed to obtain consensus. 
> As such it doesn't need shepherding or shepherding ADs, any 
> more than any other individual ID.

Really, this is irrelevant. Either there is or is not a group of people
who have done some work and reached some consensus that the work needs
to be completed in the IETF. If there is work and consensus, then even
if it was published and rejected as an individual draft, there is no
reason for the work to stop and the people to go away.

It makes more sense to channel the work appropriately rather than
rejecting it and castigating the group. We all know that the Internet
has many security issues made worse by the immense scale of the network
in this day and age. There is an entire IETF area decicated to Security
with 17 or 18 WGs in it. It seems to me that we should be advising the
people working on this draft to take their work to the Security ADs and
see if it fits into an existing WG or whether a new AD could be created.
The process nits are entirely irrelevant to the work and do not advance
the IETF in any way.

Personally, I would like to see some more criticism of the fact that
this draft is about Phishing, a symptom of security problems, rather
than about strengthening a weakness in Internet security. It is entirely
possible to "solve" the phishing problem without strengthening the
network, and possibly even introducing new weaknesses. Being too focused
on one symptom is not a good way to approach security. Indeed, it is
entirely possible that the solution to phishing lies with the banking
system, not with the Internet or IETF. 

--Michael Dillon

---

From: <[email-masked]>
Date: Mon, 10 Sep 2007 23:53:45 +0100

> No. I want there not to be an implication that the 
> development of this document is a formal activity of the IETF.

Let me give you a short lesson from IETF 101.
If the name of a draft contains ietf as the second component, or the
name of an IETF WG or the name of one of the IETF bodies (iab, irtf,
etc...) then it is a formal activity of the IETF. Otherwise it is not.
Since this ID contains hartman as the second component, then it is clear
that this in not a formal IETF draft but merely a whim of someone named
hartman, possibly with some co-conspirators.

> formation of some design team which has not gone through the 
> BOF->WG process.

Have you verified with the AD in question that they were wearing their
AD hat at the time that they "sponsored" the formation of this design
team? AD's still have some freedom to act outside the IETF.

--Michael Dillon

---

From: Paul Hoffman <[email-masked]>
Date: Mon, 10 Sep 2007 16:40:52 -0700

Wearing my co-author of the Tao of the IETF hat...

>Let me give you a short lesson from IETF 101.

Erm, no such document exists.

>etc...) then it is a formal activity of the IETF.

True.

>Otherwise it is not.

False. To be specific: true almost all the time, but not always. 
(And, yes, we muffed that in the Tao.) A draft with an indivual's 
name can be a WG document.

Further, a document that has the consensus of the IETF becomes a 
formal activity of the IETF standards process, even if it is an 
individual submission.

--Paul Hoffman, Director
--VPN Consortium

---

From: Sam Hartman <[email-masked]>
Date: Mon, 10 Sep 2007 20:05:10 -0400

>>>>> "Chris" == Chris Drake <[email-masked]> writes:

    Chris> Hi Alexey,
    >> And if you would like to suggest a better process for moving
    >> things forward, please share your opinion.

    Chris> Suggest: Properly document comments and reviews somewhere.

    Chris> Question: what's the best way to submit comments and
    Chris> reviews - can we just re-write the entire draft, annotating
    Chris> our changes, and submit that?  

You can.
I'd find it  more useful though if you simply sent in comments  where appropriate.
I.E. send a message to this list describing an issue with the draft and  your comments on how to solve it.
Specific new text is welcome but not required.

However if you find that annotating the draft is the easiest way for
you to get your point across do that.  A new text version would be far
more useful than an annotated pdf to me.

    Chris> Are professionals and
    Chris> experts even invited/allowed to comment?  

I think most of us consider ourselves computer security or web
professionals.  (I consider myself a computer security person more
than a web person).  we like to think that we have sufficient
background to be qualified to make the statements we're making.  So,
yes, I think many of us consider ourselves experts in fields related
to this work.  I'm not sure anyone today can claim to be an expert in
solving phishing as it's not particularly a solved problem.:-) But
yes, comments from people who have subject matter expertise are
greatly welcome.

    Chris> Is there a formal
    Chris> procedure for dealing with suggestions (eg: attributing,
    Chris> documenting, discussing, leading to an ultimate official
    Chris> public inclusion (or exclusion with reasoning).

I don't know if we'll end up needing that level of formality; I'm
hoping that mailing list discussion will be sufficient, but we can
develop formality if we need it.  If you're new to the IETF you may
want to take a look at http://www.ietf.org/rfc/rfc4677.txt

---

From: Spencer Dawkins <[email-masked]>
Date: Mon, 10 Sep 2007 22:05:35 -0500

FWIW

>>etc...) then it is a formal activity of the IETF.

"Almost always true..."

>>Otherwise it is not.
>
> False. To be specific: true almost all the time, but not always. (And, 
> yes, we muffed that in the Tao.) A draft with an indivual's name can be a 
> WG document.

... because a document that has been adopted by a working group, and renamed 
with the working group name, can also be UNadopted by a working group, and 
there is no requirement to rename the document so that it doesn't "look 
like" a working group document. This happens most often when WGs are 
shutting down, but it does happen.

A draft-ietf-* filename means that At Some Point the document was adopted by 
a WG (or other IETF body), but does not mean that the document currently has 
that status.

Steve Coya and Jeff Schiller always stressed in WG chair training (in the 
late 1990s) that there was no relationship between a document name and 
whether it was a WG document or not. This was entirely controlled by a flag 
in a database somewhere (which is how the WG home pages are generated, and 
how the page generator knows that the draft is a working group draft even if 
it hasn't been renamed).

I know that did not change while Margaret Wasserman was doing the training, 
and did not change while I was doing the training (both solo, and with 
Paul). It had not changed as of a year ago, and if anyone has information 
that it has changed in the past year, please share it.

Thanks,

Spencer

---

From: Willie Gillespie <[email-masked]>
Date: Tue, 11 Sep 2007 11:58:19 -0600

> want to take a look at http://www.ietf.org/rfc/rfc4677.txt

Being new, I just read over this document and found it extremely 
informative.  I wonder if it should be suggested as individuals 
subscribe to the main IETF list.

Is that a bad idea?

Willie Gillespie

---

From: Willie Gillespie <[email-masked]>
Date: Tue, 11 Sep 2007 11:58:19 -0600

Is that a bad idea?

Willie Gillespie