Subject: [saag] Barry Leiba's Discuss on draft-dukhovni-opportunistic-security-04: (with DISCUSS and COMMENT)

From: "Barry Leiba" <[email-masked]>
Date: Tue, 16 Sep 2014 17:16:54 -0700

Barry Leiba has entered the following ballot position for
draft-dukhovni-opportunistic-security-04: Discuss

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to http://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
http://datatracker.ietf.org/doc/draft-dukhovni-opportunistic-security/

----------------------------------------------------------------------
DISCUSS:
----------------------------------------------------------------------

This DISCUSS is on process grounds; I think we have two serious process
issues that prevent our claiming that we have rough consensus on the
document.

1. The community reviewed and commented on version -03.  The IESG is
being asked to approve version -04, and is being told there is rough
consensus on its content.  And yet vesion -04 is essentially a complete
rewrite of the document.  I understand the assertion that the changes are
"just editorial", but that doesn't help: the fact is that the community
has *not* reviewed anything close to the version we're being asked to
approve.  It would be a terrible precedent to say that a document could
be rewritten after last call and sent to the IESG for approval that way.

I believe that, despite any concern about the usefulness of another last
call, this document must get another last call in its current form.  To
do otherwise would be to trash our rough consensus process.

2. I think the way the document editing was done, and the way the
comments were (and were not) responded to was poor, and calls into
question what does and doesn't have rough consensus (certainly according
to RFC 7282).  There were substantive comments that were made that were
not explicitly discussed; those comments were then declared "in the
rough".  I don't believe such declaration can be made purely on the basis
of lack of visible support, with no actual discussion or refutation. 
Dave Crocker and Stephen Kent have both brought up some such issues.

I think that re-last-call needs to be accompanied by instructions for
people to raise issues that they think they raised before that were not
properly discussed, so that there is a chance for them to *be* discussed
and, perhaps, for them to be properly declared in the rough once there's
real discussion about them.  I know some people will think this is a PitA
at best, but it should have been done before.  An issue tracker,
carefully managed, would have been an appropriate tool for a document
with this much discussion -- and this much diverse discussion.

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

I also have two major issues with the document, but note that these are
*not* un the DISCUSS portion.  Consider this to be strong input, but not
part of the blocking process:

I'm quite unhappy with the decision to go with "Opportunistic Security"
here (rather than "Opportunistic Encryption", since it *is* talking about
encryption, or rather than finding another appropriately focused term if
there are good reasons not to use "OE").  My sense is that the reasons to
use "OS" amount to marketing, but there are solid reasons to use
"Encryption" when encryption is central, and not to use the overly broad
term "Security" for something that is not actually meant to be broad.

I don't like the organization of the document; I don't think it's well
written and sufficiently coherent.  I know this is vague, but short of
having me do yet another rewrite I don't know how to be more specific. 
The general thing is that topics seem to drift in and out, and the whole
document doesn't read as a clear path from one idea, through another, to
a set of conclusions.

---

From: Stephen Farrell <[email-masked]>
Date: Wed, 17 Sep 2014 01:43:25 +0100

Hi Barry,

I have some questions about your discuss:-)

This is based on my starting point that -04 is not in fact a
complete rewrite of -03, but rather a paraphrase plus some new
text, both sets of changes matching the list discussion well. I
think its entirely fair of me to stick with that assertion, (it
being correct:-). You have not provided *any* detail as to why
my assertion might be incorrect. So please do provide such detail
which I believe is needed to back up your discuss.

> http://datatracker.ietf.org/doc/draft-dukhovni-opportunistic-security/

If you tell me how this discuss point matches the discuss
criteria that'd be great. Perhaps you think "there are unresolved
and substantive Last Call comments which the document does not
address"? If so, then I think this is the same as your point #2.
If not, then please tell me how it does warrant a DISCUSS and is
not the same as point#2 since I don't get that.

> Dave Crocker and Stephen Kent have both brought up some such issues.

I think the onus is on you to specify *exactly* which issues you
mean, isn't it? It is not sufficient to name other participants
in some kind of IOU/bring-me-a-rock discuss I think. So exactly
which specific substantive issues here justify your discuss?

Separate to the above, I suspect I should start reading the DISCUSS
non-criteria probably as I'm strongly reminded of them in reading
your discuss points:-) But perhaps you checked that already and if
so can tell me why your points do not fall under that heading? (You
don't have to do that since I will, and I have no right to insist
you do that, so I won't, but if you've thought about it already we
may save a bit of time, so I'm asking:-)

Thanks,
S.

---

From: Ted Lemon <[email-masked]>
Date: Wed, 17 Sep 2014 09:27:54 -0400

On Sep 16, 2014, at 8:43 PM, Stephen Farrell <[email-masked]> wrote:
> You have not provided *any* detail as to why

Presumably you already did this as part of the consensus evaluation.   Is it really so unreasonable for Barry to ask you to show your work?

---

From: Stephen Farrell <[email-masked]>
Date: Wed, 17 Sep 2014 14:57:07 +0100

Hi Ted,

On 17/09/14 14:27, Ted Lemon wrote:
>> You have not provided *any* detail as to why my assertion might be
>> incorrect. So please do provide such detail which I believe is
>> needed to back up your discuss.
> 
> Presumably you already did this as part of the consensus evaluation.

Yes. As can you. This is unfortunately one where to arrive at your
own position you need to go check the list traffic [1] and read (as
opposed to be shocked by the volume of:-) the diffs between -03 and
-04. [2] The list traffic does include summaries of the LC at a
couple of places. [3,4] Unfortunately, it also includes a lot of
repetition before and after those messages. And to be clear, its
of course just fine if you do that and disagree with my conclusions.

> Is it really so unreasonable for Barry to ask you to show your work?

Barry has not asked for that. He has asserted that there are
DISCUSS-worthy problems but has so far provided nothing but
that assertion that I can see.

There are also the DISCUSS non-criteria which are relevant in
particular for DEFERred drafts and IOU-like discusses as seems to
me to clearly be the case here for Barry's discuss point#2. And I
have asked about his first discuss point as I'm not clear about
how it meets the DISCUSS criteria either. (It might or might not
depending on what Barry means, I think clarifying first that its
DISCUSS worthy and why will get us to closure faster.)

Cheers,
S.

[1]
https://mailarchive.ietf.org/arch/search/?email_list=ietf&q=opportunistic-security
[2]
https://tools.ietf.org/rfcdiff?url2=draft-dukhovni-opportunistic-security-04.txt
[3] https://www.ietf.org/mail-archive/web/ietf/current/msg89139.html
[4] https://www.ietf.org/mail-archive/web/ietf/current/msg89280.html

---

From: Pete Resnick <[email-masked]>
Date: Wed, 17 Sep 2014 09:41:26 -0500

> that assertion that I can see.

No, that's not what Barry's first point says. It says, "You haven't 
shown your work." It's not the same as point #2.

pr

-- 
Pete Resnick<http://www.qualcomm.com/~presnick/>
Qualcomm Technologies, Inc. - +1 (858)651-4478

---

From: Dave Crocker <[email-masked]>
Date: Wed, 17 Sep 2014 07:55:25 -0700

On 9/17/2014 6:57 AM, Stephen Farrell wrote:
> own position you need to go check the list traffic [1] 

<https://mailarchive.ietf.org/arch/msg/ietf/_EgAnnE7QvSi3O8pgEFprensnB8>

The above is a summary that demonstrates merely one of the many examples
of having basic concerns be ignored in this process.

It contains pointers to other postings that were ignored or dismissed
out of hand.

d/
-- 
Dave Crocker
Brandenburg InternetWorking
bbiw.net