Re: Review of draft-hartman-webauth-phishing-05

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 




--On Wednesday, 22 August, 2007 10:40 -0400 Sam Hartman
<hartmans-ietf@xxxxxxx> wrote:

>>>>>> "Henning" == Henning Schulzrinne <hgs@xxxxxxxxxxxxxxx>
>>>>>> writes:
> 
>     Henning> Rather than an IESG note or in addition to, I
> think the     Henning> author should clearly state, in the
> abstract, that this     Henning> is a personal opinion only.
> 
> I don't think my personal opinion would make a very useful
> document, but if that's all we can come away from this process
> with then that's all we will achieve.
> 
> 
> First, I'd rather try and build consensus and get more review.
> 
> Failing that, I think we could come up with a way of
> describing the status of this document that does not give the
> impression that it has even less review than other documents
> that are of the same status. I.E. I think it would be an
> unfortunate outcome if we feel the need to add a bunch of
> warnings in this case simply because we've had a discussion
> and realized that we don't entirely agree on what our
> documents mean.

Sam,

It is the question of how to accurately reflect the amount of
review and/or agreement that has caused me to be so concerned
about the apparently-rigid language in RFC 3932 and
interpretations of that language that make it even more rigid.

Some informational documents are better reviewed than others.
Some represent consensus about the right things to do, others
don't.  Some of those that do not represent a consensus about
what to do still represent consensus that the document a
reasonable and comprehensive description of a situation and
possibly the range of known solutions.   Any of these may be
useful (or not).   Which category a document falls into is
largely independent of whether a document goes through the IESG
track or the RFC Editor one.

IMO, the thing we need to be careful about is assertions about
IETF consensus or IETF review: If such consensus exists and has
been formally verified, or such a review actually took place and
was meaningful, it is reasonable to say that.  But the absence
of formal review or verification doesn't imply "bad" or
"dangerous" or "incompetent", it just implies that one
particular review and approval process didn't take place.

Maybe, instead of having arguments about consensus,
recommendations, and whether or not things are going to be taken
to be normative, it is time we permit --and perhaps require--
authors of Informational documents to insert a statement that
accurately describes one or both of (i) levels of review and
consensus and (ii) intended use.  It would then be a key element
of whatever review process is used to verify that such
statements are accurate.

Taking this document as an example, it would seem reasonable to
me to say "This has been discussed around the IETF and
elsewhere.  While some people agree with it, others do not and
some of the others believe it is premature with regard to both
the developing state of the art and it literature review and
citations.  It is the intention of the author that the document
be used to inform the ongoing debate and discussion, not that it
be considered normative or a constraint on future work in the
IETF or in other forums".  

If I am correct that a statement of that type accurately
represents your view and that of others who support the content
of the document, EKR's view, and reality, we would then be
finished.
 
> I think making it clear that this is not normative is quite
> important.

Obviously.  But it is only part of the problem and solution, IMO.

    john


_______________________________________________

Ietf@xxxxxxxx
https://www1.ietf.org/mailman/listinfo/ietf

[Index of Archives]     [IETF Annoucements]     [IETF]     [IP Storage]     [Yosemite News]     [Linux SCTP]     [Linux Newbies]     [Fedora Users]