Subject: [wpkops] Scope

From: Tim Moses <[email-masked]>
Date: Tue, 28 Aug 2012 14:58:15 +0000

Colleagues - As discussed, the idea is to document the Web PKI as it is practiced today.  Generally, that means considering product versions other than the most recent one from each significant supplier.  But, in order to keep the workload at a manageable level, we will have to eliminate product versions that are seldom encountered today.  Without making reference to specific products and versions, it's tough to come up with an objective criterion for identifying the versions that deserve to be documented.  Therefore, I believe we have to rely on experts' judgments.

As a guide, we might agree that, in order to warrant consideration, a technique must be involved in more than one percent of connections that use the Web PKI.  While we would not attempt to apply this threshold with any precision, contributors may appeal to it in order to justify their exclusion of a particular technique. Then the disputant would be called upon to demonstrate that the technique was more prevalent.

What do others think?

All the best.  Tim.

---

From: Adam Langley <[email-masked]>
Date: Tue, 28 Aug 2012 11:09:13 -0400

> As a guide, we might agree that, in order to warrant consideration, a technique must be involved in more than one percent of connections that use the Web PKI.  While we would not attempt to apply t…

1% seems reasonable although, if anything, a little high. There are
workarounds that apply to less than 1% but are, none the less,
important. But any number 0.1%..1% seems sane.

Cheers

AGL

---

From: Rick Andrews <[email-masked]>
Date: Tue, 28 Aug 2012 09:56:02 -0700

Tim, I think the 1% fuzzy threshold is fine. But I really hope that the sum total of connections that use Web PKI includes mobile browsers and apps. I've heard anecdotally that mobile represents a large and ever-growing share of web use, and I think it's essential to include it.

-Rick

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of
> Adam Langley
> Sent: Tuesday, August 28, 2012 8:09 AM
> To: Tim Moses
> Cc: [email-masked]
> Subject: Re: [wpkops] Scope
> 
> > Colleagues - As discussed, the idea is to document the Web PKI as it is
> practiced today.  Generally, that means considering product versions other
> than the most recent one from each significant supplier.  But, in order to
> keep the workload at a manageable level, we will have to eliminate product
> versions that are seldom encountered today.  Without making reference to
> specific products and versions, it's tough to come up with an objective
> criterion for identifying the versions that deserve to be documented.
> Therefore, I believe we have to rely on experts' judgments.
> >
> > As a guide, we might agree that, in order to warrant consideration, a
> technique must be involved in more than one percent of connections that use
> the Web PKI.  While we would not attempt to apply this threshold with any
> precision, contributors may appeal to it in order to justify their exclusion
> of a particular technique. Then the disputant would be called upon to
> demonstrate that the technique was more prevalent.
> >
> > What do others think?
> 
> _______________________________________________
> wpkops mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/wpkops

---

From: Tim Moses <[email-masked]>
Date: Tue, 28 Aug 2012 16:59:35 +0000

Hi Rick.  I completely agree.  It's covered in the last paragraph of the draft charter.  In the near future I'll distribute an updated charter proposal.  All the best.  Tim.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Rick Andrews
Sent: Tuesday, August 28, 2012 12:56 PM
To: Adam Langley; Tim Moses
Cc: [email-masked]
Subject: Re: [wpkops] Scope

-Rick

> From: [email-masked] [mailto:[email-masked]] On 
> Behalf Of Adam Langley
> practiced today.  Generally, that means considering product versions 
> other than the most recent one from each significant supplier.  But, 
> in order to keep the workload at a manageable level, we will have to 
> eliminate product versions that are seldom encountered today.  Without 
> making reference to specific products and versions, it's tough to come 
> up with an objective criterion for identifying the versions that deserve to be documented.
> technique must be involved in more than one percent of connections 
> that use the Web PKI.  While we would not attempt to apply this 
> threshold with any precision, contributors may appeal to it in order 
> to justify their exclusion of a particular technique. Then the 
> disputant would be called upon to demonstrate that the technique was more prevalent.
> >
> > What do others think?
>

---

From: Randy Turner <[email-masked]>
Date: Tue, 28 Aug 2012 12:26:03 -0700

Hi Tim,

So, in a nutshell (because this is an OPS effort), we're doing to:

1. Document existing practice, given the most prevalent products, and
2. Given existing practice, analyze this existing practice for a set of BCPs

Is this correct?

Thanks!
Randy

---

From: Tim Moses <[email-masked]>
Date: Tue, 28 Aug 2012 19:29:56 +0000

Hi Randy.  That's right.  Hopefully, this will be a precursor to fixing some of the issues with the Web PKI.  But, step one is to "catalog" what we have.  So, we'll start by producing a set of BCPs that document major aspects of the Web PKI as it is generally practiced today.

All the best.  Tim.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Randy Turner
Sent: Tuesday, August 28, 2012 3:26 PM
To: [email-masked]
Subject: Re: [wpkops] Scope

Hi Tim,

1. Document existing practice, given the most prevalent products, and 2. Given existing practice, analyze this existing practice for a set of BCPs

Is this correct?

Thanks!
Randy

On Aug 28, 2012, at 9:59 AM, Tim Moses wrote:

> Behalf Of Rick Andrews
>> eliminate product versions that are seldom encountered today.  
>> Without making reference to specific products and versions, it's 
>> tough to come up with an objective criterion for identifying the versions that deserve to be documented.

---

From: Peter Saint-Andre <[email-masked]>
Date: Tue, 28 Aug 2012 13:37:00 -0600

On 8/28/12 1:29 PM, Tim Moses wrote:
> Hi Randy.  That's right.  Hopefully, this will be a precursor to 
> fixing some of the issues with the Web PKI.  But, step one is to 
> "catalog" what we have.  So, we'll start by producing a set of
> BCPs that document major aspects of the Web PKI as it is generally 
> practiced today.

I'm not sure if those would really be BCPs or Informational, but we'll
burn that bridge when we come to it. ;-)

Peter

- -- 
Peter Saint-Andre
https://stpeter.im/

---

From: Stephen Farrell <[email-masked]>
Date: Tue, 28 Aug 2012 21:57:10 +0100

> burn that bridge when we come to it. ;-)

Right.

While there can be debates about how to label RFCs (and
even better, the outcome of those debates varies over
time;-) that's something that can be decided on a case
by case basis e.g. as you add milestones or later.

In this case, I guess you can think of it as follows:

- If a document just says what's out there but isn't trying
to encourage anyone to do thing in that precise way (or to not
do that) then its informational.

- If a document is recommending to do stuff "this" way,
then its more of a BCP.

- There're grey bits in between.

If you want the official word on that, you can read the
bit of rfc 2026 that describes BCPs [1] but note what I
said above - we have folks involved in the IETF who can
debate this stuff endlessly.

Better to decide what you wanna do though and not get
hung up on status.

S.

[1] http://tools.ietf.org/html/rfc2026#section-5

---

From: Stephen Farrell <[email-masked]>
Date: Tue, 28 Aug 2012 22:04:28 +0100

So in addition, I was hoping this group would document
use-cases and requirements for new protocols or changes
to current protocols if the wg figure some are needed
so that we could spin-up short-lived SEC or other WGs
as needed.

I'm not gonna stamp my feet if folks don't want to do
that but I'd hope to get that kind of output so's we
can concentrate on new protocol work in this space
that'll be more likely to get adopted.

(I would stamp my feet if folks wanted to specify new
protocols in this group.)

Cheers,
S.

---

From: "Steingruebl, Andy" <[email-masked]>
Date: Tue, 28 Aug 2012 21:12:17 +0000

> Behalf Of Stephen Farrell
> 
> So in addition, I was hoping this group would document use-cases and
> requirements for new protocols or changes to current protocols if the wg
> figure some are needed so that we could spin-up short-lived SEC or other
> WGs as needed.

I view this sort of like I view  Zalewski's browser security handbook (http://code.google.com/p/browsersec/wiki/Main).

Anywhere we document a behavior using a chart or some such and the behavior differs, or we can't point to an underlying spec that allows for the variance, we should seriously consider spinning up some standards work, and hope that we can get everyone to adopt.

I don't think this is a misplaced hope/plan at all :)

- Andy

---

From: Jon Callas <[email-masked]>
Date: Tue, 28 Aug 2012 14:21:05 -0700

> so that we could spin-up short-lived SEC or other WGs

I think that is *precisely* one of the things this group should be doing.

As we've noted Web PKI isn't precisely what -- umm, what's the correct back-formation? -- orthodox PKI? -- is. Those deltas cam out of real-world use cases that had real-world requirements. It's best to discuss them along with the use cases because the use cases are the whys.

	Jon

---

From: Randy Turner <[email-masked]>
Date: Tue, 28 Aug 2012 14:37:36 -0700

to emphasize Tim's desire for reduced scope, I am thinking that during the generation of a set of BCPs, if we find glaring holes in what's going on, then the group could be re-chartered to address and document use-cases and new requirements.

Randy

---

From: Sean Turner <[email-masked]>
Date: Tue, 28 Aug 2012 18:26:52 -0400

On Aug 28, 2012, at 5:21 PM, Jon Callas <[email-masked]> wrote:

>    Jo

For what it's worth this was one of my primary wants out of this effort.

Spt

---

From: Tom Ritter <[email-masked]>
Date: Tue, 28 Aug 2012 18:35:35 -0400

On 28 August 2012 18:26, =JeffH <[email-masked]> wrote:
> Additionally, I was about to point to the browser security handbook (BSH) as
> perhaps an example of what sort of document(s) wpkops will craft for web pki
> -- one(s) featuring tables with rows denoting features/behavior and columns
> denoting implementations. Different tables address different topics.
>
> https://code.google.com/p/browsersec/wiki/Part2

> For what it's worth this was one of my primary wants out of this effort.

The Browser Security Handbook lists implementations and the
observations about those implementations. But this group intends to
list observations about implementations, along with hand-waving
percentages... with no information about what implementation we're
talking about?  (I don't have any problem with hand-waving percentages
for the record.)

We're not scared talking about Browser Security features.  And we're
not talking about _vulnerabilities_ in hardware devices that would be
difficult to patch and leave people vulnerable... It's just everyone
seems to clam up when it comes time to say who actually can't support
compression or whatever. I know no one is actually trying to
perpetuate some sort of coverup - but at the same time *believing*
that there's no nefarious purpose and still not seeing any info is
pretty frustrating.

-tom

---

From: Stephen Farrell <[email-masked]>
Date: Tue, 28 Aug 2012 23:45:51 +0100

> that there's no nefarious purpose and still not seeing any info is

I'm sure there're ways to handle this. And since we're talking
about an OPS area WG, other WGs will have figured out ways and
means. I've asked a couple of folks, since I don't know myself.

Cheers,
S.

---

From: Tim Moses <[email-masked]>
Date: Wed, 29 Aug 2012 18:48:09 +0000

All - Here's what I had in mind.  Tell me if you think it won't work.  (What am I saying?  Of course you're going to tell me.)

I saw the purpose of this project as "identifying issues" with the way that the Web PKI works, based on a complete and common understanding.  We may have different opinions on which of those issues needs to be addressed and with what priority.  But, there will be less room for dispute over whether or not the issue exists, or the extent to which it exists.

I didn't want to commit to writing requirements unless and until we have the enthusiastic participation of the browser and Web server suppliers.  Without their involvement, there is no reason to believe that they would accept such requirements, or that significant considerations had been omitted or misunderstood when writing them.

Documenting how things "actually" work (I hope) will foster a well-informed discussion about what works well and what could work better.  The discussion may occasionally stray into potential solutions.  And, while such discussions would be out-of-scope, and therefore have to be cut short, it should be easier to agree what further actions are required.

So, in a sense, there are two types of deliverable: the BCP or info RFCs, and the mail-list discussion about what to do next.  And, if we are successful, the latter will be the more valuable.

All the best.  Tim.

-----Original Message-----
From: Stephen Farrell [mailto:[email-masked]] 
Sent: Tuesday, August 28, 2012 5:04 PM
To: Tim Moses
Cc: 'Randy Turner'; [email-masked]
Subject: Re: [wpkops] Scope

So in addition, I was hoping this group would document use-cases and requirements for new protocols or changes to current protocols if the wg figure some are needed so that we could spin-up short-lived SEC or other WGs as needed.

I'm not gonna stamp my feet if folks don't want to do that but I'd hope to get that kind of output so's we can concentrate on new protocol work in this space that'll be more likely to get adopted.

(I would stamp my feet if folks wanted to specify new protocols in this group.)

Cheers,
S.

On 08/28/2012 08:29 PM, Tim Moses wrote:
> Behalf Of Randy Turner