Subject: [domainrep] Proposed charter, revised after BoF

From: "Murray S. Kucherawy" <[email-masked]>
Date: Mon, 1 Aug 2011 23:30:18 -0700

Attached is a revised charter based on the minutes Barry posted on Thursday.  Thanks to Barry for chairing the BoF and Jeff Hodges for taking notes.

Please give it a once-over and let me know if you think it reflects the discussion we had.  Once there's agreement, I'll send it to the ADs for their consideration.

-MSK

---

From: Johan Pouwelse <[email-masked]>
Date: Tue, 2 Aug 2011 20:44:10 +0200

Nicely formulated charter.

I'm very much in favour of a focussed charter. However, currently the
charter is {overly} narrow.
One of the key lessons of the BoF was in my estimation the strong,
diverse and energetic interest.
There is a thriving group of academics out there, like me, who would
love to help.
For instance, see the strong publication record here:
http://scholar.google.com/scholar?q=reputation+system
Please don't cut them out of this community. An official IETF REPUTE
charter would give them guidance+motivation for their work.

May I propose reformulating like:

	The working group will focus initially only on the
	specific application of reputation about domain names found in
	email messages, as it is believed there exists sufficient experience
	and expertise in that area. If successful progress has been made,
        in the form of four accepted working group Standards track documents
        we will take a limited step to generalise beyond domain names.
	The working group will cover at maximum two additional application spaces
        where it feels it can access to sufficient expertise and experience.

Or is this slightly wider scope not acceptable for Working Group
acceptance process?

 -j
On 2 August 2011 08:30, Murray S. Kucherawy <[email-masked]> wrote:
> Attached is a revised charter based on the minutes Barry posted on
> Thursday.  Thanks to Barry for chairing the BoF and Jeff Hodges for taking
> notes.
>
>
>
> Please give it a once-over and let me know if you think it reflects the
> discussion we had.  Once there’s agreement, I’ll send it to the ADs for
> their consideration.
>
>
>
> -MSK
>
> _______________________________________________
> domainrep mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/domainrep
>
>

---

From: "John Levine" <[email-masked]>
Date: 2 Aug 2011 22:52:13 -0000

It's basically fine, but the bit about RBLs (which aren't even called
RBLs any more) seems a bit out of touch.  How about this as a
replacement for the paragraph that starts "Reputation system such as ..."

   Reputation systems may publish reports that the subjects of the
   reports consider to be wrong, due to error, malice or a
   combination.  The group will consider the feasibility and utility
   of systems to dispute or challenge information published by a
   reputation system.  It will also consider the feasibility and
   utility of meta-reputation systems, to rate the accuracy and
   relability of reputation systems, and ways that reputation systems
   can operate transparently.

I spscifically took out redress and lawsuits, since they are way
outside the IETF's expertise.

R's,
John

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Tue, 2 Aug 2011 16:18:47 -0700

> -----Original Message-----
> From: John Levine [mailto:[email-masked]]
> Sent: Tuesday, August 02, 2011 3:52 PM
> To: [email-masked]
> Cc: Murray S. Kucherawy
> Subject: Re: [domainrep] Proposed charter, revised after BoF
> 

That works for me.

---

From: "J.D. Falk" <[email-masked]>
Date: Tue, 2 Aug 2011 17:34:54 -0700

>> replacement for the paragraph that starts "Reputation system such as
 [ . . . ]
> That works for me.

+1

More generally, I think we need to keep the initial charter tightly focused.  Johan is absolutely right about the vast and varied interest in reputation in the academic community and elsewhere, but I'd be concerned that leaving things loose would result in vast and varied conversations which never actually result in work getting done.  I'd be in favor of adding one more vocabulary to this first charter, but we should decide what it will be now rather than leaving it open.

If other people want to work on additional vocabularies or extensions as individual submissions, of course, that's fine.  The WG can always recharter to adopt any drafts which have sufficient interest and momentum.

--
J.D. Falk
the leading purveyor of industry counter-rhetoric solutions

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Tue, 2 Aug 2011 20:37:44 -0700

> From: [email-masked] [mailto:[email-masked]] On Behalf Of J.D. Falk
> Sent: Tuesday, August 02, 2011 5:35 PM
> To: [email-masked]
> If other people want to work on additional vocabularies or extensions
> as individual submissions, of course, that's fine.  The WG can always
> recharter to adopt any drafts which have sufficient interest and
> momentum.

The feeling I got in the room, especially from our AD, is that this is probably the preferred path.  People interested in spaces other than email domain names can certainly work to keep the framework and protocols extensible as needed, but the first vocabulary/application the work supports will probably need to be constrained.

If that's wildly successful, I suspect much more latitude will be granted in a recharter.

---

From: Nathaniel Borenstein <[email-masked]>
Date: Tue, 9 Aug 2011 16:14:33 -0400

I, too, am largely fine with the charter.  However, in the spirit of constructive nitpicking:

General comment:  I agree that we should be focused on the email domain reputation use case, but I also agree with Johan that we shouldn't let this focus make us miss the chance to do the general framework properly.  I would like to see us declare any use-cases other than domain reputation to be out of scope, but also explicitly declare as in-scope a secondary goal of structuring the protocol in such a way as to separate the basic mechanism from the application/use-case/vocabulary.  (See "Proposed Addition" below.)

Description of Working Group:

> 	reputation data providers make available to consumers data about

Consumers?  Perhaps we mean users?

	illustrating the requirement and defining mechanisms to satsify it.

Typo: satisfy

	The working group will focus for its initial charter only on the

s/only/primarily/  (because of the generalized syntax question)

	specific application of reputation about domain names found in
	email messages, as it is believed there exists sufficient experience
	and expertise in that area.  

Proposed Addition: "However, the WG will attempt to define the syntax and mechanisms in such a way that other applications and vocabularies can be developed without changes to the basic protocol."

Goals and Milestones:
	mmm yyyy:	

I disagree, I think we can be done by nnn zzzz.

Seriously, do we have any idea what dates to shoot for?  I would think the first document or two could be ready for the Paris IETF in March, is that unrealistically ambitious?  -- Nathaniel

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Tue, 9 Aug 2011 13:24:51 -0700

> From: Nathaniel Borenstein [mailto:[email-masked]]
> Sent: Tuesday, August 09, 2011 1:15 PM
> To: Murray S. Kucherawy
> Cc: [email-masked]

I used "consumers" there in the producer/consumer vein, but I'm fine with "users" too.

I'm fine with the rest of your proposed tweaks and additions.

> I disagree, I think we can be done by nnn zzzz.

Right, sorry.  Typo.

> Seriously, do we have any idea what dates to shoot for?  I would think
> the first document or two could be ready for the Paris IETF in March,
> is that unrealistically ambitious?  -- Nathaniel

Yep, I suspect so, given the absence of major objections to the framework or reputon drafts so far.  Most of the back-and-forth has been about protocol definition.

-MSK

---

From: Johan Pouwelse <[email-masked]>
Date: Tue, 9 Aug 2011 23:41:18 +0200

> Proposed Addition: "However, the WG will attempt to define the syntax and mechanisms in such a way that other applications and vocabularies can be developed without changes to the basic protocol."

Good idea.

Who can object to apple pie and re-usable technology..

 -johan

---

From: SM <[email-masked]>
Date: Wed, 10 Aug 2011 21:55:34 -0700

Hello,

Nitting about the proposed charter:

   "However, anyone can create and attach such an identifier."

I suggest "However, anyone can assign such an identifier." as there 
is no attachment for
RFC4408.  BTW, would the work also cover RFC 4406?

Regards,
-sm

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Wed, 10 Aug 2011 22:08:54 -0700

> From: [email-masked] [mailto:[email-masked]] On Behalf Of SM
> Sent: Wednesday, August 10, 2011 9:56 PM
> To: [email-masked]
> is no attachment for RFC4408.

How about:

        Determining the trustworthiness of content on the Internet remains a
        challenge, and this weakness is heavily exploited by bad actors.
        Various mechanisms have been developed for associating a verified
        identifier with email content, such as SPF (RFC4408) and DKIM
        (RFC4871).  However, legitimate and illegitimate users alike can
        take advantage of these schemes.  What is also required is a
        meaningful assessment of the trustworthiness of the identifier's
        owner.  This in turn permits making a meaningful choice about what
        to do with the associated content.

> BTW, would the work also cover RFC 4406?

With this rewording, yes.  It's only omitted because it's not in anywhere near as widespread use as those two are, but RFC4406 certainly is included as a possible email authentication protocol.

-MSK

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Wed, 10 Aug 2011 22:16:26 -0700

> Proposed Addition: "However, the WG will attempt to define the syntax
> and mechanisms in such a way that other applications and vocabularies
> can be developed without changes to the basic protocol."

How's this?

        The working group will focus for its initial charter on an
        extensible framework of syntax and mechanisms for reputation services,
        and primarily on the specific application of reputation about domain
        names found in email messages, as it is believed there exists
        sufficient experience and expertise in that area.  The framework will
        allow other applications and vocabularies to be developed without
        changes to the basic protocol.  Then, if successful, the group can
        re-charter to cover other application spaces where it feels it can
        access sufficient expertise.

> is that unrealistically ambitious?  -- Nathaniel

I think so, yes.  I'll post an updated charter with this week's feedback and some milestone guesstimates shortly.

---

From: SM <[email-masked]>
Date: Thu, 11 Aug 2011 03:19:25 -0700

Hi Murray,
>         to do with the associated content.

That looks fine.

>With this rewording, yes.  It's only omitted because it's not in 
>anywhere near as widespread use as those two are, but RFC4406 
>certainly is included as a possible email authentication protocol.

Ok.

Regards,
-sm