Subject: Re: [marf] Document status(es)

From: "Murray S. Kucherawy" <[email-masked]>
Date: Sun, 1 Jan 2012 22:37:10 -0800

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of Alessandro Vesely
> Sent: Saturday, December 31, 2011 2:59 AM
> To: [email-masked]
> Subject: Re: [marf] Document status(es)
> 
> My understanding is that redaction is sometimes necessary or useful,
> but even then the WG has no final solutions.  We just propose an
> algorithm, and thus the document is informative.  If aiming at PS
> implies devising a protocol for thoroughly redacting messages, I
> suggest we don't.

I don't think the redaction document has any such lofty goals.  It's a technique that can be applied that is both effective and useful (at least, just as effective and more useful than replacing the sensitive stuff with "xxxxxxxx").  And it's starting to see some uptake already.

"Thoroughly redacting messages" seems to me to be the same thing as not sending a report at all; any complaint you make, no matter how small, could potentially reveal something.

---

From: Alessandro Vesely <[email-masked]>
Date: Mon, 02 Jan 2012 14:26:24 +0100

On 02.01.2012 07:37, Murray S. Kucherawy wrote:
>> From: ietf.org On Behalf Of Alessandro Vesely
>
>> If aiming at PS implies devising a protocol for thoroughly redacting
>> messages, I suggest we don't.
> 
> I don't think the redaction document has any such lofty goals.

Indeed, it doesn't even say in what cases redaction is applicable.  It only
recalls that

   Precisely how this is done is unspecified in [ARF] as it will
   generally be a matter of local policy.  That specification does
   admonish generators against being too over-zealous with this
   practice, as obscuring too much data makes the report non-actionable.

The second sentence seems to be construed for an Informational doc that talks
about a Standard.  Should it be amended if changing status to PS?  Or maybe
the document should state that it specifies the algorithm only, so that it is
clear that no other goals are intended.

I see no other corners that may deserve attention when turning to PS.

BTW, s/identity of then end user/identity of the end user/.

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Mon, 2 Jan 2012 21:37:31 -0800

In case there are people not watching the list due to the holidays, I'll wait a couple of days before moving ahead, but I think consensus is leaning toward changing the redaction document to Proposed Standard, and then requesting a second IETF Last Call on both of them.  If those Last Calls are initiated by the end of Wednesday, they will complete in time for their currently-scheduled 1/19 IESG Evaluations.

I've prepared an updated redaction document with that in mind, and I'll work with Hilda to get an updated authfailure-report document ready as well, taking into account the IESG and Gen-ART feedback we've received so far.

If there are any other opinions about a way forward (or just more support for the apparent preferred path), please say so soon.

-MSK

---

From: SM <[email-masked]>
Date: Tue, 03 Jan 2012 02:02:09 -0800

At 21:37 02-01-2012, Murray S. Kucherawy wrote:
>In case there are people not watching the list due to the holidays, 
>I'll wait a couple of days before moving ahead, but I think 
>consensus is leaning toward changing the redaction document to 
>Proposed Standard, and then requesting a second IETF Last Call on 
>both of them.  If those Last Calls are initiated by the end of 
>Wednesday, they will complete in time for their currently-scheduled 
>1/19 IESG Evaluations.

My preference is to keep the references as they are now and go for 
the second Last Call with the usual downref 
disclaimer.  draft-ietf-marf-redaction-03 documents a practice.

Regards,
-sm

---

From: Pete Resnick <[email-masked]>
Date: Tue, 3 Jan 2012 10:09:31 -0600

On 1/3/12 4:02 AM, SM wrote:

> My preference is to keep the references as they are now and go for the 
> second Last Call with the usual downref disclaimer.  
> draft-ietf-marf-redaction-03 documents a practice.

The redaction document *proposes* a *standard* way of doing redaction. 
Indeed, the document specifically says that previous practices for 
redaction cause problems operationally and therefore it *proposes* a 
better way for everyone to do it. Furthermore, authfailure-report is 
clearly referring to this practice in a normative way. I am having a 
hard time understanding how this "documented practice" is not a 
"proposed standard" and why I should not last call it that way.

pr

-- 
Pete Resnick<http://www.qualcomm.com/~presnick/>
Qualcomm Incorporated - Direct phone: (858)651-4478, Fax: (858)651-1102

---

From: SM <[email-masked]>
Date: Tue, 03 Jan 2012 08:56:17 -0800

Hi Pete,
At 08:09 03-01-2012, Pete Resnick wrote:
>The redaction document *proposes* a *standard* way of doing 
>redaction. Indeed, the document specifically says that previous 
>practices for redaction cause problems operationally and therefore 
>it *proposes* a better way for everyone to do it.

Based on the above argument, draft-ietf-marf-redaction-03 fits within 
"proposed standard".

Regards,
-sm

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Tue, 3 Jan 2012 09:51:31 -0800

> From: [email-masked] [mailto:[email-masked]] On Behalf Of SM
> Sent: Tuesday, January 03, 2012 8:56 AM
> To: Pete Resnick
> Cc: [email-masked]
> >better way for everyone to do it.
> 

Accordingly, I've posted a new version if draft-ietf-marf-redaction that seeks Standards Track status.  Pete, LC at your discretion.

-MSK