Re: Transparency in Specifications and PRISM-class attacks

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Sep 20, 2013, at 13:38, Hannes Tschofenig <hannes.tschofenig@xxxxxxx> wrote:

> 2) Are there documents you find non-readable?

I'm not sure you aren't mocking us, but...

*Yes*, there are documents in the IETF that are highly non-accessible.

I could name examples from areas other than security, but probably the most glaring example in the security area is the maze of twisty little passages that the TLS spec is.

Many of the specifications that make up TLS are of the form "MMM is almost like [RFCNNNN], except that.".  Of course, RFCNNNN says "NNN is almost like [RFCQQQQ], except that.".  In the end, you need several weeks of analysis, heaping layer over layer of changes, with increasing uncertainty of what the spec resulting from this layer cake really says.  Also when trying to ascertain a specific property, all these changes have to be examined again, and it is really easy to misinterpret one of these changes, coming up with the wrong conclusion.  The whole thing reminds me of the old concept of an "interfiled" loose-leaf service update, except that the new pages are never actually sorted in but you are keeping all the updates around together with the original set to check them in sequence whenever you need a specific page.

I think I understand how the current situation came about, but I think it qualifies for "documents you find non-readable".

Grüße, Carsten

PS.: Harald: The SDP spec is bad in large parts because of the mission creep; SDP was great for its uses in 1993 but is excruciatingly bad for what it is being used for today.  It's a disaster we didn't manage to replace it in time before the complexity ballooned...






[Index of Archives]     [IETF Annoucements]     [IETF]     [IP Storage]     [Yosemite News]     [Linux SCTP]     [Linux Newbies]     [Fedora Users]