On 12/31/2013 12:48 PM, John C Klensin wrote:
So, at the risk of repeating something others have said, I don't
want to see a Last Call (or, worse, post-Last Call) debate about
whether the authors of a document that isn't seen to be secure
enough against persuasive surveillance has done everything that
might be possible to mitigate that risk.
As always, folks should take special note, when John and I agree on
something. (Although in this realm of discussion, we usually do.)
In this case, I raised similar concerns some time ago:
http://www.ietf.org/mail-archive/web/ietf/current/msg84897.html
where the basic message is:
We should not approve an IETF policy statement
until we have a good idea of the way we will use it.
The current draft does not come close to satisfying that requirement.
In fact from what I've seen, the community has been quite diligent at
avoiding all discussion of practicalities.
A document like this draft is a good idea. But it can't reasonably be a
Best Current Practices until the community has some idea of what the
practices will (and should) be.
Until then, publishing this document is merely an emotional exercise
that is frankly certain to cause more confusion than insight.
d/
--
Dave Crocker
Brandenburg InternetWorking
bbiw.net