Subject: [perpass] privacy/PM reviews of existing stuff

From: Stephen Farrell <[email-masked]>
Date: Wed, 29 Jan 2014 13:55:47 +0000

Hiya,

One idea that came up in Vancouver and that we (meaning at least
me:-) haven't had a chance to progress was the idea of trying to
get a team of folks together to go do privacy reviews of existing
RFCs. Or perhaps slightly differently, reviews that explicitly
consider pervasive monitoring, which might be more constrained
and a bit easier.

I think Christian H. commented at the mic that there is probably
a *lot* of low hanging fruit out there, and I suspect he's quite
right:-)

Now that we're in the run up to the London IETF, if some of you
had time to try self-organise that kind of thing that'd be great.
Any takers for trying to organise that?

Using this list to start with should be fine, if it results in
loads of traffic we can spin up a new one, or move over to
[email-masked].

If there are folks willing to take this on and having a
side-meeting in London helps, I can get you a room for that.

Thanks,
S.

---

From: Scott Brim <[email-masked]>
Date: Wed, 29 Jan 2014 09:16:04 -0500

First, what are the goals of getting organized? ☺  Some of us already
consider privacy as a matter of course for new drafts (I do gen-art reviews
in addition to WG reviews). I don't think we want to organize a group to
comment on new material - it would be better get privacy/pm to be included
in security considerations. My goal for a group would be to organize
reviews of *existing* drafts/RFCs that are in common use. It shouldn't take
a lot of work, maybe just a wiki page.

I'm enthusiastic about having a side meeting in London.

Scott

---

From: Stephen Farrell <[email-masked]>
Date: Wed, 29 Jan 2014 14:33:06 +0000

On 01/29/2014 02:16 PM, Scott Brim wrote:
> First, what are the goals of getting organized? ☺ 

Fighting chaos chaotically:-)

> Some of us already
> in security considerations. 

Absolutely.

> My goal for a group would be to organize

Yep. I expect that the first thing to do would be that, to
recruit some willing folks and then figure out what's doable
based on their expertise, interests and available cycles,
and on which RFCs that group figure might provide the
best payoffs, e.g. RFcs that the group figured are likely
to be revised/extended would probably be better targets
than things we think won't or can't be changed.

> I'm enthusiastic about having a side meeting in London.

Cool. I bet a bit of f2f discussion could be fruitful
here if we can get some good folks in a room.

S.

> 
> Scott
> 
> 
> 
> _______________________________________________
> perpass mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/perpass
>

---

From: Klaas Wierenga <[email-masked]>
Date: Wed, 29 Jan 2014 16:41:57 +0100

Hey Scott,

On Jan 29, 2014, at 3:16 PM, Scott Brim <[email-masked]> wrote:

> First, what are the goals of getting organized? ☺  Some of us already consider privacy as a matter of course for new drafts (I do gen-art reviews in addition to WG reviews). I don't think we want to organize a group to comment on new material - it would be better get privacy/pm to be included in security considerations. My goal for a group would be to organize reviews of *existing* drafts/RFCs that are in common use. It shouldn't take a lot of work, maybe just a wiki page.
> 

happy to be involved!

Klaas

---

From: Dave Crocker <[email-masked]>
Date: Wed, 29 Jan 2014 07:50:52 -0800

> consider pervasive monitoring, which might be more constrained
...
> Any takers for trying to organise that?

Doing reviews for attention to PM is really an experimental activity. 
We don't have a track record of those specific types of reviews and I 
believe we are some distance away from having a shared, usable model of 
what to review for.

But we do need to develop it.

So I think what you are proposing actually ought to be its own 
development project, with the goal of producing a document in the realm 
of "Guidelines for doing Pervasive Monitoring Reviews of IETF 
Specifications."

d/

-- 
Dave Crocker
Brandenburg InternetWorking
bbiw.net

---

From: Scott Brim <[email-masked]>
Date: Wed, 29 Jan 2014 11:05:06 -0500

On Wed, Jan 29, 2014 at 10:50 AM, Dave Crocker <[email-masked]> wrote:

> Doing reviews for attention to PM is really an experimental activity. We
> don't have a track record of those specific types of reviews and I believe
> we are some distance away from having a shared, usable model of what to
> review for.
>

Yes we do, it's just not organized. For example, there was good discussion
of the draft for IPv6 addressing in moving vehicles, and it led to changing
the applicability. Maybe you're thinking we don't have an understanding of
the attack vectors. That may be, but we do know what we want to protect.
See the drafts/RFCs and slides from perpass. I think the criteria are
pretty clear, they just take some digging to understand.

> So I think what you are proposing actually ought to be its own development
> project, with the goal of producing a document in the realm of "Guidelines
> for doing Pervasive Monitoring Reviews of IETF Specifications."
>

That would be useful, as long as it's kept up to date.

Scott

---

From: Spencer Dawkins <[email-masked]>
Date: Wed, 29 Jan 2014 10:06:00 -0600

I should be assuming that everyone else has already thought of this, but ...

On 01/29/2014 09:50 AM, Dave Crocker wrote:
> believe we are some distance away from having a shared, usable model 
> of what to review for.
>
> development project, with the goal of producing a document in the 
> realm of "Guidelines for doing Pervasive Monitoring Reviews of IETF 
> Specifications."

Dave's suggestion is likely a great second-wave suggestion.

I took Stephen's suggestion and offer of a room as a great first-wave 
suggestion, and I had assumed that we weren't talking about reviewing 
all 7000-odd existing RFCs, but that people likely have a few widely 
deployed protocols in mind where they're already worrying about privacy 
aspects, reviewing widely deployed protocols that people are already 
worried about would be useful on its own, and might very well be the 
basis for developing guidelines that Dave is suggesting.

So, the worriers would self-organize in London as a first step.

If I got that wrong, my bad, and I'll go annoy people about transport 
issues, of course :-)

Spencer

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Fri, 31 Jan 2014 11:38:41 +0100

On Wed, Jan 29, 2014 at 01:55:47PM +0000,
 Stephen Farrell <[email-masked]> wrote 
 a message of 33 lines which said:

> privacy reviews of existing RFCs.

Just to check that I understand you correctly: do you think that
Internet-Drafts like draft-bortzmeyer-dnsop-dns-privacy are such
"privacy reviews of existing RFC"? If yes, are there other examples to
follow? If not, what is missing in it?

I miss a privacy review of IP, which would help to answer questions
like "is the IP address a personal identifier" or "is IPv6 better or
worse than IPv4 for privacy, taking into account CGN and things like
that"

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Fri, 31 Jan 2014 11:50:26 +0100

On Wed, Jan 29, 2014 at 07:50:52AM -0800,
 Dave Crocker <[email-masked]> wrote 
 a message of 35 lines which said:

> We don't have a track record of those specific types of reviews and
> I believe we are some distance away from having a shared, usable
> model of what to review for.

We don't start from zero, we have already RFC 6973 and its section 8
is a very good example of privacy/PM analysis of an existing protocol.

---

From: Joseph Lorenzo Hall <[email-masked]>
Date: Fri, 31 Jan 2014 09:52:04 -0500

Stephen and perpassians,

Please count myself and our new technologist, Runa Sandvik (formerly
of Tor), as willing and ready here. We are very new to the IETF and
although I've read the Tao and have great mentors among you, I don't
think we'd be the best leading the effort, but able troops.

Unfortunately, we can only attend STRINT (if invited) and the first
two days of IETF 89 as we have to be back in DC for CDT's 20th
anniversary (https://cdt.org/techprom).

best, Joe

On 1/29/14, 8:55 AM, Stephen Farrell wrote:
> consider pervasive monitoring, which might be more constrained and
> a bit easier.
> 
> I think Christian H. commented at the mic that there is probably a
> *lot* of low hanging fruit out there, and I suspect he's quite 
> right:-)
> 
> Now that we're in the run up to the London IETF, if some of you had
> time to try self-organise that kind of thing that'd be great. Any
> takers for trying to organise that?
> 
> Thanks, S.
> _______________________________________________ perpass mailing
> list [email-masked] 

- -- 
Joseph Lorenzo Hall
Chief Technologist
Center for Democracy & Technology
1634 I ST NW STE 1100
Washington DC 20006-4011
(p) 202-407-8825
(f) 202-637-0968
[email-masked]
PGP: https://josephhall.org/gpg-key
fingerprint: 3CA2 8D7B 9F6D DBD3 4B10  1607 5F86 6987 40A9 A871