Subject: RE: IETF 65 BOF Announcement: Digital Identity Exchange (DIX)

From: "Hollenbeck, Scott" <[email-masked]>
Date: Sun, 12 Feb 2006 20:55:29 -0500

> -----Original Message-----
> From: Dave Crocker [mailto:[email-masked]] 
> Sent: Sunday, February 12, 2006 7:47 PM
> To: [email-masked]
> Cc: Ted Hardie; Hollenbeck, Scott
> Subject: Re: IETF 65 BOF Announcement: Digital Identity Exchange (DIX)
> 
> 

[snip]

> ps. I happen to the the general topic of online identities is 
> rich with 
> opportunities to be productive and I am carefully offering no 
> comment about the 
> current proposal.  My immediate concern is that we know 
> better than to conduct 
> this sort of BOF in this sort of manner.

What sort of manner is that, Dave?  That's a serious question.  There is
an open mailing list on which discussion has been taking place since the
Vancouver meeting.  There is still a month to continue discussion before
Dallas.  If something is too broad or not clear, please share your
thoughts on the dix list so that appropriate changes can be considered.

For what it's worth, I consider shooting down an idea to be one
potential outcome of a successful BOF.  While the members of the list
appear to be reaching consensus on an approach, the rest of the
community might feel otherwise.  I can't judge community consensus by
watching the list discussions in isolation.  I approved this BOF to give
the rest of the IETF community a chance to see what's being considered.
If it's not ready for prime time, the proponents need to hear that --
but they need to have the chance to hear that opinion.

-Scott-

_______________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf

---

From: "Steven M. Bellovin" <[email-masked]>
Date: Sun, 12 Feb 2006 21:11:00 -0500

In message <[email-masked]

>thoughts on the dix list so that appropriate changes can be considered.

I think Dave has a point.  It's not that there should be an active 
mailing list first -- ADs generally require a list and an I-D first, 
per RFC 2418 (a pointer to which should be in 
http://www.ietf.org/ietf/1bof-procedures.txt).  The problem is that 
most people don't know about BoFs.  I might be interested in tracking 
this one, but I learned of it only through John's voluntary posting to 
the IETF list.  I agree with Dave -- BoFs should indeed be posted to 
the ietf-announce list as soon as they're approved.  (By the same 
token, people proposing BoFs should announce their mailing lists quite 
widely.  This one, for example, should have been sent to the SAAG list, 
among many other places, given the strong interest many security folks 
have in such issues.)

		--Steven M. Bellovin, http://www.cs.columbia.edu/~smb

---

From: Dave Crocker <[email-masked]>
Date: Sun, 12 Feb 2006 18:14:10 -0800

>>   My immediate concern is that we know 
>> better than to conduct 
> Vancouver meeting.

Sorry.  I missed the ietf-wide announcement of that list, made long enough ago 
to permit extended online discussion, as a lead-in to this BOF, to ensure 
consideration from a wide variety of perspectives.

That discussion would permit the BOF to take place with enough community history 
to make it possible to have a productive BOF.  (I thought I covered that concern 
in my previous note.)

Anyhow, please point me at the announcement, since the mere existence of a list 
that few know about does not mean much.  (Based on the list archive, and the 
comments emerging now, I am not the only one who missed that announcement.)

>  There is still a month to continue discussion before

You think that one month is enough time for meaningful, pre-BOF discussion of a 
topic like this?

You have a very different sense of the IETF's metabolic rate, for complex 
topics, than I do.

As I noted in my previous message, there is quite a strong basis for believing 
that it will be very, very difficult to get useful community convergence on 
goals and approaches.

For example, please explain to me why the prediction I made about the likely 
course of the upcoming BOF is inaccurate.  Or please explain why such a course 
is productive.

> potential outcome of a successful BOF. 

Scott, no.  What I am trying to point out to you is that there will not be a 
reasonable basis for making *any* sort of assessment.

All we are going to get is the usual confusion of strong opinions, without any 
considered dialogue.  It has become the norm for IETF BOF's, on any interesting, 
difficult topic.

> but they need to have the chance to hear that opinion.

In my previous notes I have tried to explain why a "start from scratch" approach 
for a BOF is just plain wasteful.  That wastefulness has been demonstrated 
enough times that one would expect us to learn the lesson.

d/

-- 

Dave Crocker
Brandenburg InternetWorking
<http://bbiw.net>

---

From: "RL 'Bob' Morgan" <[email-masked]>
Date: Mon, 13 Feb 2006 08:27:40 -0800 (PST)

On Sun, 12 Feb 2006, Dave Crocker wrote:

> Sorry.  I missed the ietf-wide announcement of that list, made long 
> enough ago to permit extended online discussion, as a lead-in to this 
> BOF, to ensure consideration from a wide variety of perspectives.

It might not meet your requirements for an ietf-wide announcement, but the 
announcement of the list and its topic was sent to the IETF list on 19
October 2005, with extended followup discussion.  That discussion 
questioned how aggressive BoF-initiators should be in recruiting 
participants ...

  - RL "Bob"

---

Date: Wed, 19 Oct 2005 16:28:05 +0200
From: Harald Tveit Alvestrand <[email-masked]>
To: [email-masked]
Subject: Spam in the IETF's name?

Found this one in my spam folder, and it made me wonder.....

1) On first read (use of term "IETF mailing list", use of term "we" without 
qualification), this sounds like an IETF-sanctioned activity. Is it?
If not, who does John Merrels speak on behalf of?

2) Even if it is, is mass-like mailing (rather than sending to the IETF 
list, the IETF-announce list, or one-on-one personal mails) a reasonable 
way to recruit people?

                     Harald

---------- Forwarded Message ----------
Date: 18. oktober 2005 01:36 +0100
From: John Merrells <[email-masked]>
To: (I have removed this list)
Subject: Invitation to join the Digital Identity Exchange IETF mailing list

Hello,

We'd like to invite you to join the IETF mailing list for discussion of
protocols and schema for exchange of digital identity information.

For background information this keynote address delivered at
OSCON 2005 presents the vision we wish to realize:

http://www.identity20.com/media/OSCON2005/

And, these 'laws of identity' define the properties of an acceptable
user-centric identity information architecture:

http://www.identityblog.com/stories/2005/07/25/thelaws.html

To subscribe to the mailing list send an email with the message
body 'subscribe' to:

[email-masked]

In addition there will be a meeting held at the next IETF,
November 5-11 in Vancouver. This will be an opportunity to
discuss digital identity issues face to face, and to consider
whether the IETF should formally consider protocols for
exchange of digital identity information. We'd like to welcome
you to join us in Vancouver for that conversation.

John Merrells

---

From: Dave Crocker <[email-masked]>
Date: Mon, 13 Feb 2006 21:48:03 -0800

> It might not meet your requirements for an ietf-wide announcement, but 
> the announcement of the list and its topic was sent to the IETF list on 19
> October 2005, with extended followup discussion.  

Although it is a bit strange to have a pre-wg mailing list run on the ietf.org 
server, with a closed invitation list, that doesn't really seem so terrible to 
me.  Seeding initial discussions in this way could be useful to get initial 
discussions started, but with some chance of coherence.

But that is strictly as a pre-cursor to an open announcement, of course.

So I think we are back to the concern that the open announcement needs to be 
earlier enough to allow serious discussion prior to holding the BOF.

d/
-- 

Dave Crocker