Subject: [websec] DISCUSS positions on draft-ietf-websec-key-pinning

From: Barry Leiba <[email-masked]>
Date: Thu, 14 Aug 2014 11:47:18 -0400

Websec folks, and especially the document authors:
We have several DISCUSS ballots on the key-pinning doc (from Stephen,
Kathleen, and Ted):

   http://datatracker.ietf.org/doc/draft-ietf-websec-key-pinning/ballot/

...and I have seen no response from the authors on them.  Please
respond soonest, and have the necessary discussions to resolve them.
Please also consider and respond to the non-blocking comments from
Alissa, Pete, and Richard.

Yoav, please stay on top of this and do the necessary prodding to keep
this moving.

Thanks,
Barry

---

From: Barry Leiba <[email-masked]>
Date: Thu, 14 Aug 2014 13:21:40 -0400

> It sounds like you're looking for an acknowledgement of the messages. Just
> to confirm, we have received this feedback, and are taking time to ensure
> the replies are as considered and thoughtful as the DISCUSS points,
> especially as many of these points were discussed early on and thought
> addressed by the draft already.

Great; thanks, Ryan.

Yes, it's always good to at least send a "we're working on it" message
in response, especially to DISCUSS positions (as those are
specifically asking for discussion).

So we'll take this as "we're working on it, and we'll get back to
y'all when we have a good response," and thanks for confirming that.

Barry

---

From: Ryan Sleevi <[email-masked]>
Date: Thu, 14 Aug 2014 09:20:40 -0700

On Aug 14, 2014 8:47 AM, "Barry Leiba" <[email-masked]> wrote:
> ...and I have seen no response from the authors on them.

Hi Barry.

In addition to these poibts, the feedback/recent errata from Eric Lawrence
regarding HSTS is also extremely relevant to the discussion of HPKP, and we
were waiting to see what actions, if any, the WG takes regarding that
draft, lest we find ourselves immediately writing a bis to deal with those
same points.

> Please

---

From: Tobias Gondrom <[email-masked]>
Date: Sun, 17 Aug 2014 21:04:30 +0100

> y'all when we have a good response," and thanks for confirming that.

Hi Ryan,

in addition to the recommendation from Barry: please feel free to reply 
to the discusses as soon as possible. We are now in IESG review and an 
extensive discussion within the WG is not required to deal with 
discusses if the issues have been raised and resolved in the WG before.

So e.g. if you think that a discuss has already been addressed during a 
previous WG discussion, please feel free to write so to the reviewing AD 
(with cc to the WG). And repeat a quick brief of the reasoning for the 
benefit of the reviewer who has not been part of the WG discussion before.

Furthermore I would recommend to not wait for any HSTS update 
discussions. It is not clear whether they will happen or not at this 
stage. So to wait for them may not be fruitful.

In general it would be good to answer questions in the current IESG 
review process phase timely and one by one as that will help the ADs to 
close the process on the draft in a timely manner. If we wait too long, 
some may need to read the draft again just to refresh their memory when 
casting their vote to publish.

Just a thought, Tobias (no hat)

---

From: Barry Leiba <[email-masked]>
Date: Sun, 17 Aug 2014 17:15:31 -0400

> In general it would be good to answer questions in the current IESG review
> process phase timely and one by one as that will help the ADs to close the
> process on the draft in a timely manner. If we wait too long, some may need
> to read the draft again just to refresh their memory when casting their vote
> to publish.

This is a good point, and thanks for making it, Tobias.  Yes, it's
frequently the case that too much delay in having the discussion
causes the AD to have to regain context, which results in more delay
and disrupts the AD's other work more.

Barry

---

From: Yoav Nir <[email-masked]>
Date: Tue, 19 Aug 2014 18:37:46 +0300

What Barry and Tobias said. 

Additionally:

On Aug 14, 2014, at 7:20 PM, Ryan Sleevi <[email-masked]> wrote:
> In addition to these poibts, the feedback/recent errata from Eric Lawrence regarding HSTS is also extremely relevant to the discussion of HPKP, and we were waiting to see what actions, if any, the WG takes regarding that draft, lest we find ourselves immediately writing a bis to deal with those same points.
> 
> 
I don’t know what is going to come of the issue that Eric found. It’s entirely possible that nothing will come out of it, or that we’ll have a document updating HSTS, or that we’ll have a document profiling the deployment of HSTS.

Either way, this will require more discussion either in this working group or elsewhere. If we wanted to make a change like this to HPKP, that would require pulling the publication request and sending the document back to the working group. I don’t think any of us wants that.

So, I think you should make all the necessary changes regardless of Eric’s issue, so that we can progress HPKP. If that issue later leads to a new RFC, it can update and/or profile HPKP at the same time as it does HSTS.

This should not impede our progress.

Yoav