Subject: Diversity and offensive terminology in RFCs

From: Niels ten Oever <[email-masked]>
Date: Thu, 20 Sep 2018 11:25:58 +0200

Hi all,

On the hrpc-list [0] there has been an intense conversation which was
spurred by the news that the Python community removed Master/Slave
terminology from its programming language [1].

In the discussion that followed it was remarked that in RFCs terms like
Master/Slave, blacklist/whitelist, man-in-middle, and other terminology
that is offensive to some people and groups is quite common.

This is not a discussion that can be resolved in hrpc, but rather should
be dealt with in the IETF community (because hrpc doesn't make policy
for terminology in the IETF), which is why I am posting this here.

If people find the discussion worthwhile, we might also be just in time
to request a BoF on this topic.

Looking forward to discuss.

Best,

Niels

[0] https://mailarchive.ietf.org/arch/browse/hrpc/
[1]
https://motherboard.vice.com/en_us/article/8x7akv/masterslave-terminology-was-removed-from-python-programming-language

-- 
Niels ten Oever
Researcher and PhD Candidate
Datactive Research Group
University of Amsterdam

PGP fingerprint	   2458 0B70 5C4A FD8A 9488
                   643A 0ED8 3F3A 468A C8B3

---

From: Riccardo Bernardini <[email-masked]>
Date: Thu, 20 Sep 2018 12:22:44 +0200

I think that it is important to discuss it in order to avoid further
degeneracy in this direction.

I expect that what I am going to say will be quite unpopular, but I think
that a line need to be draw somewhere.  Do not get me wrong, I am totally
in favor of diversity, inclusiveness and avoiding offensive language, but
in the cases at hand (master/slave and blacklist/whitelist) the expressions
never had any negative or offensive weight and if someone gets offended by
some concatenation of ideas, that is a problem of its.

I mean, it is like a neighbor that complains because when you come home
from work at 6pm you take a shower.  "I am having dinner at that time and
hearing the water of your shower make me thing about bathrooms just when I
am eating."  If this seems exaggerate to you, please note that it is not
too different from being offended by master/slave because reminds you about
slave trades happened few centuries ago. (BTW, slavery has not been limited
to that period, so I guess many people should be offended).   Also
whitelist/blacklist _never_had_any_racial_meaning_ at all. .  If they
remind you about racism, the problem is definitively on your side.
Another example is currently discussed on inksscape mailing lists: someone
complained because inkscape has a translation in pig latin (as I understand
was added for testing and then it remained there) and the term "pig latin"
offended him (I know it is a "him" because I know the name).

The idea "let's not offend anyone," while good in theory leave you open to
the attack of definitively oversensitive people.  I mean, if I say "Do not
wear a tie.  It looks like a phallic symbol and it offends me.  Moreover,
it is sexist." are you going to prohibits ties?

What is the limit of reasonable complaints and when a complaint is
excessive?  Difficult to say, as in many other cases the border between
reasonabilit and excess is fuzzy, nevertheless there are cases that are
clearly on one side.  The cases master/slave, whiteist/blacklist and "pig
latin" are definitively, IMHO, on the excessive side.

Running for cover...

R.

---

From: Stewart Bryant <[email-masked]>
Date: Thu, 20 Sep 2018 07:25:45 -0400

The problem with the many proposed alternative versions of Master/Slave that I have seen over the years, is that they fail to express the technical importance of the absolute relationship between the two entities.

The term master/slave is used when it is technically required that the instruction is executed without equivocation. Indeed in hardware-land, dithering over what to do (metastability) is so catastrophic that many technical measures need to be taken to avoid it.

If all the master-slave flip-flops in the Internet were replaced with do-it-if-I-feel-like-it flip-flops, we would not have an Internet.

In RFC-land we are mirroring the long-standing language of the hardware designers, and having a common terminology that transcends all aspects of logic design seems to me to be a net benefit to the internet as a whole.

Stewart

---

From: Petr Špaček <[email-masked]>
Date: Thu, 20 Sep 2018 13:29:24 +0200

> In RFC-land we are mirroring the long-standing language of the hardware designers, and having a common terminology that transcends all aspects of logic design seems to me to be a net benefit to the…

Yes, we always need to take context into account!

I fully agree with with Stewart and Riccardo (previous reply) on this.

-- 
Petr Špaček  @  CZ.NIC

---

From: Niels ten Oever <[email-masked]>
Date: Thu, 20 Sep 2018 13:41:10 +0200

On 09/20/2018 01:25 PM, Stewart Bryant wrote:
> The term master/slave is used when it is technically required that the instruction is executed without equivocation. 

Would leader/follower (as implemented by Django) not work just as well?
It seems to work for them for quite a while already.

Best,

Niels

---

From: Dave Cridland <[email-masked]>
Date: Thu, 20 Sep 2018 12:51:18 +0100

Back when I was even more clueless than I am today, and actually ran DNS
servers, we used the terms "primary" and "secondary" as a matter of course.
Secondaries copied the data from primaries.

So far, so good.

Then we added a third nameserver, and of course that must be the tertiary,
used only when *both* the primary and secondary had failed.

When I realised my stupidity, I avoided the terms "primary" and "secondary"
in the workplace, and instead used the terms "master" and "slave", which
were less easily confused - or rather, made me less easily confused by
them. The fact that "master/slave" was well understood within engineering
helped enormously.

But it's possible to remove the word "slave" easily - indeed, when
discussing distributed systems such as clustering, the literature tends to
refer to a "master", but not so much to "slaves".

"Blacklist" and "whitelist" are well-known terms, but they can be avoided
with small effort to provide synonyms which are more easily understood -
"Blocklist" and "Permitlist" are trivial examples here. But if someone says
"There is a whitelist", then I also know the default is to deny. So we'll
need to be a bit more explicit about the default state, perhaps. In other
words, I worry about changing these terms, but the possibility for
confusion is low if we do.

"Man-in-the-middle" I'm clearly too stupid to understand why this might be
offensive, but equally I have no idea what term of art would suffice
instead.

I have no objection to thinking twice before using a term that could
offend, but I have huge objections to replacing existing terms with new
ones that could confuse instead.

But still, I'm a white male living in a country that hasn't had slaves
within its own borders, at least, for over a thousand years, so I freely
admit I may not understand the gravity of the situation.

So I'd like to hear from actual people who are actually made to feel
uncomfortable about these terms, rather than people saying that other
people have heard of some people who might be offended.

Dave.

---

From: Loa Andersson <[email-masked]>
Date: Thu, 20 Sep 2018 19:52:12 +0800

Niels,

You could make anything work, but it would probably cause a lot
of pain and confusion.

In a master/slave situation the master tells the salve what to do,
and there is no way to discuss it. leader/follower does not bring the
same type of understanding over, I've worked for a lot of good leaders
(and some bad ones :) ), but part of what a good leader do, is to be
prepared to take the discussion e.g. when the follower don't want to
follow.

I'd say if we had a master/slave situation among humans it would be a
bad thing, if we have it among networking nodes, I don't particularly
care about the terminology.

/Loa

-- 

Loa Andersson                        email: [email-masked]
Senior MPLS Expert
Bronze Dragon Consulting             phone: +46 739 81 21 64

---

From: Mukund Sivaraman <[email-masked]>
Date: Thu, 20 Sep 2018 17:32:10 +0530

In my very early DNS days, I used to feel uncomfortable typing "slave"
though I've become used to it now that I don't think twice.

We've had some discussions about this in my previous DNS team about
"master" and "slave" in DNS terminology. Note that the preferred terms
now are "primary" and "secondary" respectively per RFC 7719. I'll use
master and slave below because I want the descriptions to make sense in
that context.

In DNS, the meaning of master/slave, from a driver perspective, doesn't
strictly capture what happens in the DNS protocol. It is the slave that
queries the master to do something for it (return zone data), and the
master does work on the slave's behalf. It is the slave that drives it -
the master strictly cannot instruct the slave to do something (NOTIFY is
a notification that a slave can avoid or not even handle).

>From a coupling perspective, though the slave for a zone synchronizes
its zone data to the data on the respective master, there's no
requirement in DNS for the slave to be tightly coupled to the master.
i.e., it is the slave's choice whether it feels like updating this
moment, and it may not do so, whereby after a time interval it should
stop serving the zone.

There is also another concept of "master" in DNS which is the master
file. Though it describes presentation format (a syntax) for zone data
storage, the concept of master here is used analogous to "master copy"
e.g, for a video or audio recording, i.e., something like the main copy
of the data.

When there are other and better terms to describe the entities such as
"primary" and "secondary", there's no need to stick to words that offend
some people. It may not offend you, but you may not have lived a life in
a family/community where such things have affected you.

IMO, there's no need to drive out all references to master/slave usage,
but newer usage should try to find more appropiate terms, and software
should allow usage of alternate terms. If "slave" is the only English
term that you can find, just ask a colleague.

These are generic usage terms and do not identify a product such as a
trademark to cling onto them. E.g., GIMP (GNU image manipulation
program) gets a lot of complaints again and again about its name. But
re-branding it is not a small feat - it would break a lot of things. One
could say GIMP has redefined the term too (e.g., if you do a web search,
you'd find very results of the derogatory usage). Master/slave is not
like that, at least in my limited area of DNS.

		Mukund

---

From: Anne-Marie Eklund-Löwinder <[email-masked]>
Date: Thu, 20 Sep 2018 12:09:06 +0000

Hi all,

Some time ago we had a standardisation committee in Sweden, running a project defining the terminology in Swedish for the information security area. They came up with
Janus-attack rather than man in the middle-attack (the latter sounds weird in Swedish).

Janus was a two faced God from ancient Roman religion/myth. He was the God of beginnings, gates, transitions, time, duality, doorways, passages, and ending.
https://en.wikipedia.org/wiki/Janus

It didn't take off unfortunately, I consider it quite clever. 

That said, I can't really see how the term "Man-in-the-middle" can be offensive.

Kind regards,

Anne-Marie Eklund Löwinder
Chief Information Security Officer
IIS (The Internet Infrastructure Foundation)
Phone: +46 734 315 310
https://www.iis.se

Visitors: Hammarby Kaj 10D
Mail: Box 92073, 120 07 Stockholm

> -----Ursprungligt meddelande-----
> Från: ietf <[email-masked]> För Dave Cridland
> Skickat: den 20 september 2018 13:51
> Till: [email-masked]
> Kopia: [email-masked] Discussion <[email-masked]>
> Ämne: Re: Diversity and offensive terminology in RFCs
> 
> were less easily confused - or rather, made me less easily confused by them.
> The fact that "master/slave" was well understood within engineering helped
> enormously.
> 
> But it's possible to remove the word "slave" easily - indeed, when discussing
> distributed systems such as clustering, the literature tends to refer to a
> "master", but not so much to "slaves".
> 
> "There is a whitelist", then I also know the default is to deny. So we'll need to
> be a bit more explicit about the default state, perhaps. In other words, I
> worry about changing these terms, but the possibility for confusion is low if
> we do.
> 
> offensive, but equally I have no idea what term of art would suffice instead.
> 
> I have no objection to thinking twice before using a term that could offend,
> but I have huge objections to replacing existing terms with new ones that
> could confuse instead.
> 
> But still, I'm a white male living in a country that hasn't had slaves within its
> own borders, at least, for over a thousand years, so I freely admit I may not
> understand the gravity of the situation.
> 
> On Thu, 20 Sep 2018 at 10:26, Niels ten Oever <[email-masked]
> <mailto:[email-masked]> > wrote:
> 
> 
> 	Hi all,
> 
> 	https://motherboard.vice.com/en_us/article/8x7akv/mastersl
> ave-terminology-was-removed-from-python-programming-language
> 
> 
> 	--
> 	Niels ten Oever

---

From: "Roberta Maglione (robmgl)" <[email-masked]>
Date: Thu, 20 Sep 2018 12:15:49 +0000

I agree with the comments made below: in my opinion there is nothing wrong in using terms like master/slave, white/black lists, man-in the middle, etc.
In the context of IETF we are using them as part of technical discussions: if you don’t take them out of the context in my opinion there is nothing wrong with these words.

Thanks
Roberta

-----Original Message-----
From: ietf <[email-masked]> On Behalf Of Petr Špacek
Sent: Thursday, September 20, 2018 13:29
To: [email-masked]
Subject: Re: Diversity and offensive terminology in RFCs

-- 
Petr Špaček  @  CZ.NIC

---

From: Ole Troan <[email-masked]>
Date: Thu, 20 Sep 2018 14:25:01 +0200

There is one word used a lot in the IETF that I find terribly offensive though.

IPv4.

Can we get rid of that?

O.

> On 20 Sep 2018, at 11:25, Niels ten Oever <[email-masked]> wrote:
> 
> Hi all,
>

---

From: Michal Krsek <[email-masked]>
Date: Thu, 20 Sep 2018 14:48:12 +0200

Hello,

I understand those words may be inappropriate in some contexts, but they 
are fine in other contexts.

Not touching the IT area, how we teach history?

I'd say - our master/slave act means something else than enslaving 
people, man-in-the-middle is a system not a male person, debugging means 
something else than disinfection and so on.

We do have our jargon for long time and I'm not sure if it is a clever 
idea to start building a Tower of Babel 
https://en.wikipedia.org/wiki/Tower_of_Babel .

                     Michal

---

From: Tony Finch <[email-masked]>
Date: Thu, 20 Sep 2018 13:51:15 +0100

A lot of this problematic terminology is metaphorical in some way. If you
strive to use descriptive terms, rather than metaphorical terms, then you
should end up with language that is more straightforward and clear.

For example, block list / allow list.

Primary / replica. Source / sink. Upstream / downstream.

Active interception / passive snooping.

Tony.
-- 
f.anthony.n.finch  <[email-masked]>  http://dotat.at/
Hebrides, Bailey: Cyclonic, becoming north or northwest, 5 to 7, occasionally
gale 8 at first in Hebrides. Rough or very rough, occasionally moderate in
Hebrides. Squally showers. Good, occasionally moderate.

---

From: Job Snijders <[email-masked]>
Date: Thu, 20 Sep 2018 12:59:25 +0000

> For example, block list / allow list.

This for me is a good example of an improvement. I've used the terms
white/blacklist a lot in context of teaching routing security around
the world, but I now see that allowlist/blocklist is a far better (and
prescriptive) term.

I appreciate this being discussed in IETF.

Kind regards,

Job

---

From: Anton Ivanov <[email-masked]>
Date: Thu, 20 Sep 2018 14:11:03 +0100

> Would leader/follower (as implemented by Django) not work just as well?

No.

A follower is following the leader because it has agreed to be lead. As 
correctly noted by Stewart, in a master/slave hardware (or software) 
configuration nobody asks the slave about its opinion on things.

> It seems to work for them for quite a while already.

And? So what?

A.

---

From: Anton Ivanov <[email-masked]>
Date: Thu, 20 Sep 2018 14:15:11 +0100

On 9/20/18 1:48 PM, Michal Krsek wrote:
> Hello,
>
> I understand those words may be inappropriate in some contexts, but 
> they are fine in other contexts.
>

Presently? In most of the World? By rewriting it. So let's not even go 
there and not use that as a gold standard.

> people, man-in-the-middle is a system not a male person, debugging 
> means something else than disinfection and so on.
>

+1. I propose we keep things as is.

They are not anywhere as offensive as some other IT terminology like for 
example using "grooming" to describe the process of evaluating current 
bugs and issues. And let's not even start on what routing means in some 
parts of the English speaking world.

A.

>> I agree with the comments made below: in my opinion there is nothing 
>> wrong in using terms like master/slave, white/black lists, man-in the 
>> middle, etc.
>> In the context of IETF we are using them as part of technical 
>> discussions: if you don’t take them out of the context in my opinion 
>> there is nothing wrong with these words.
>>
>> Thanks
>> Roberta
>>
>>
>>> The problem with the many proposed alternative versions of 
>>> Master/Slave that I have seen over the years, is that they fail to 
>>> express the technical importance of the absolute relationship 
>>> between the two entities.
>>>
>>> The term master/slave is used when it is technically required that 
>>> the instruction is executed without equivocation. Indeed in 
>>> hardware-land, dithering over what to do (metastability) is so 
>>> catastrophic that many technical measures need to be taken to avoid it.
>>>
>>> If all the master-slave flip-flops in the Internet were replaced 
>>> with do-it-if-I-feel-like-it flip-flops, we would not have an Internet.
>>>
>>> In RFC-land we are mirroring the long-standing language of the 
>>> hardware designers, and having a common terminology that transcends 
>>> all aspects of logic design seems to me to be a net benefit to the 
>>> internet as a whole.

---

From: "Adrian Farrel" <[email-masked]>
Date: Thu, 20 Sep 2018 14:21:51 +0100

Long ago and far away, I did some code and documentation work for a large multinational. Part of the work described return codes carried on responses when the input parameters were not acceptable.

We were told off for using the string "Invalid value" because that could be deemed offensive. There is still code out there that ambiguously reports "Parameter contains unexpected value." We did settle on "not valid" instead.

Of course some terms have associated meanings that make the use of those terms unacceptable in any circumstance. (Who would be a supplier of bundles of sticks in the modern world? And possibly we are lucky to have picked the term "link bundle".) But those words were usually made bad by intended derogatory use not by the facts that they described. Thus, the only alternative way to correctly describe the relationship currently known as "master/slave" is to invent a new phrase that has exactly that meaning (such as "demanding-client/compelled-server") or to find another phrase that already exists and has exactly the same meaning.

Given the disruption caused by a change in terminology, we should only act when there is need. As others have said, the best way to identify such a need is for those who are insulted or otherwise harassed to speak up. It is not efficient for others (many of whom, like me, have their own histories of benefit and oppression) to project. Of course, speaking up in public is hard and uncomfortable, but we have an Ombudsteam in place for exactly such issues and I am confident that they or any member of our leadership (ADs, IAB) would be very happy to hear of any concerns and would channel them with full confidentiality.

Adrian

> From: ietf [mailto:[email-masked]] On Behalf Of Niels ten Oever
> Sent: 20 September 2018 12:41
> To: Stewart Bryant; Riccardo Bernardini
> Cc: IETF Discussion
> > The term master/slave is used when it is technically required that the
> instruction is executed without equivocation.
>

---

From: Jaap Akkerhuis <[email-masked]>
Date: Thu, 20 Sep 2018 15:22:14 +0200

Anne-Marie Eklund-Löwinder writes:

 > SKIP

RFC 3761 (ENUM), 3833 (DNS), 6810 6811 8210 (RPKI), 7909 (RPSL)
uses about "monkey-in-the-middle".

PS. These are not related to "The Infinite Monkey Protocol Suite
(IMPS), RFC 2795.

	jaap

---

From: Toerless Eckert <[email-masked]>
Date: Thu, 20 Sep 2018 15:26:01 +0200

I also find the stereotyping of names in signalling terminology highly
offensive and non-inclusive: https://en.wikipedia.org/wiki/Alice_and_Bob

Why are only Alice and Bob so chatty to always have the most conversations ? 
Won't Carol get depressions from always being a third rail ? Will your kids
ever get jobs if you name them Craig, Mallory, Eve or Heidi ?  And so on.
These SIP heads are ruining the life of our kids!

*sigh*

Keep your virtue signalling out of my language!

--
Toerless

---

From: Andrew Sullivan <[email-masked]>
Date: Thu, 20 Sep 2018 09:31:58 -0400

> configuration nobody asks the slave about its opinion on things.

Well, ok, but in (e.g.) the DNS, the slave actually is in the position
to refuse the zone transfer on the grounds that it is malformed.  This
happens sometimes, so in fact in at least one prominent use of these
terms in the IETF the absolute power of the "master" is not true.  I
am aware of other examples, too, so if the justification is the
absolute slavishness (if you'll pardon the word) of the putative
slaves, I think the description isn't quite correct anyway.

For whatever it's worth, I have no opinion about whether this bit of
language needs to change, though I do somewhat prefer the
"primary/secondary" usage.  Note that these terms denote a logical
relationship, not a temporal or existential one, so there can be
multiple primaries (in some cases) and multiple secondaries
(frequently).  It does seem to me that, if one wishes to communicate
with others, it's often a good idea to avoid causing them offense.

Best regards,

A

-- 
Andrew Sullivan
[email-masked]

---

From: Kathleen Moriarty <[email-masked]>
Date: Thu, 20 Sep 2018 09:34:05 -0400

> These SIP heads are ruining the life of our kids!

And what if your last name were Moriarty?  You'd never have the community
be okay with you as a Security AD? ;-)

I'm fine with Block/permit lists, but don't think there is a racial
connotation to black/white list.  White lists being preferred may be where
the issue arrises I'm guessing.  Switching would be fine with me.

I already say active interception or session hijacking and think that's a
fine replacement for man-in-the-middle.  I didn't see an issue with
man-in-the-middle.

I do recall a recent draft coming through the IESG (within the last year or
so) with monkey-in-the-middle and remember doing some searches on it prior
ro entering comments on the draft.  I think it was commented on by an AD,
but don't remember where that landed.

Best regards,
Kathleen

-- 

Best regards,
Kathleen

---

From: [email-masked]
Date: Thu, 20 Sep 2018 13:38:36 +0000 (UTC)

first they came for the semi-colons,
and I did not complain,
for I was not a semi-colon

python has absolutely no problem favouring and promoting whitespace, which is racist as.
whitespace is so important it gets to come first in the queue on the line. because it's white.

and it's a class-based language, and all the classes are selfish

_this_ is the language you're starting social justice programming in?

Lloyd [email-masked]

On Thursday, September 20, 2018, 7:25 pm, Niels ten Oever <[email-masked]> wrote:

Hi all,

Best,

Niels

---

From: Carsten Bormann <[email-masked]>
Date: Thu, 20 Sep 2018 15:50:26 +0200

I’ve got two stories here that may or may not be relevant.

(1) In CP360, an early IBM operating system, there was a command to terminate a virtual machine.   Originally, that was called KILL.   IBM changed that to FORCE at some kind, because KILL seemed too harsh.   I don’t think anyone was “offended” by KILL, but this is still a very American way to say this (e.g., we don’t normally “kill" things in the German language).   UNIX still uses “kill” for terminating (sending a signal to) a process, but here it helps that process names are just numbers, while in CP360 they were text names and often just were the name of the responsible person, so the command might very well have been “KILL CARSTEN”.  I’m not sure “FORCE CARSTEN” is that much better, though...

(2) When we set up our first official DNS name server here in Bremen, of course I wanted to name it “ns.<domain>”.  That was in the early 1990s, and I got lots of push back.  This was in Germany, and “NS” had been the short form of “NSDAP” 50 years ago and was thus simply not something a German would ever want to say again.  Of course there is no link between naming computer servers and names of political parties, but still this felt weird.  Again, nobody would have been “offended” by this choice of name, it just felt extremely weird to a German.  We got over that, and our name servers are now happily chugging along as “ns.<domain>” (and generally, the taboo status of certain words and abbreviations has certainly softened after another 25 years or so — we can even say “national” again without blushing).

So maybe we shouldn’t reduce the question of the proper appropriation of words from another semantic domain, to whether someone somewhere currently chooses to be offended by them or not, but maybe also think about whether we want to look like that insensitive clod to a particular community or we actually don’t have a reason to care.

(And yes, there are many, many communities that each one of us is not a part of and doesn’t even begin to understand what makes you an insensitive clod in that community.)

Grüße, Carsten

---

From: [email-masked]
Date: Thu, 20 Sep 2018 13:59:43 +0000 (UTC)

unfortunately, mentioning Janus falls preyto the same internet filters that regularly censor Scunthorpe.

think of the children!

'intercepting intermediary' or 'intercemediary' works for me.

On Thursday, September 20, 2018, 10:09 pm, Anne-Marie Eklund-Löwinder <[email-masked]> wrote:

Hi all,

Kind regards,

---

From: Paul Wouters <[email-masked]>
Date: Thu, 20 Sep 2018 10:04:01 -0400 (EDT)

On Thu, 20 Sep 2018, Kathleen Moriarty wrote:

> And what if your last name were Moriarty?  You'd never have the community be okay with you as a Security AD? ;-)

For years I bit my lip instead of asking "family of?" :)

> but don't think there is a racial connotation to black/white list.  White lists being preferred may be where the issue
> arrises I'm guessing.  Switching would be fine with me.

These small implications do add up to a group of people feeling the
negative practical effects, so I think we should work on not being
an even very small part of the problem.

> I already say active interception or session hijacking and think that's a fine replacement for man-in-the-middle.  I didn't see an issue with
> man-in-the-middle.

It's similar to "manned spaceflight". NASA's guidelines have been for
a very long time to use "crewed flight". If that helps a single girl to
not deem becoming an astronaut[1] as impossible, that's a win. Although
it is also a little different here because I hope no girls aspire to
become a man-in-the-middle :)

I think monkey/machine in-the-middle works and it allows us to keep
using the MITM acronym. And "session hijacking" to me could be done
without being in the path, so I wouldn't equate the two terms.

Paul

---

From: Paul Wouters <[email-masked]>
Date: Thu, 20 Sep 2018 10:12:15 -0400 (EDT)

> whitespace is so important it gets to come first in the queue on the line. because it's white.

Since I use white text on a black screen, it is misnamed anyway! It's
blackspace for me!

We should call it blancspace obviously.

I also remember they had excellent coffee at IETF 95 Buenos Aires
at a place called Negro and it felt like a weird name to me until I
learned some more Spanish :P

Joking aside, Niels does bring a valid point, and it would be nice if we
got some guidelines for avoiding these existing known words, and prevent
us from creating new problematic ones.

---

From: Toerless Eckert <[email-masked]>
Date: Thu, 20 Sep 2018 16:31:03 +0200

> be okay with you as a Security AD? ;-)

Maybe perception of an appropriate criminal pedigree was actually a plus for
your career in security ;-)

> the issue arrises I'm guessing.  Switching would be fine with me.

Thinking beyond my frustration with virtue signalling:

When i learned about computers, my english from scchool was pretty lousy,
so i learned a lot of words with their "computer" meaning first.
And then i often wondered how/why those words where choosen when
i looked up their real world" meaning. 

Aka: For inclusiveness with non-native english speakers, there is
something to be said about choosing a language that minimizes the
required cultural and historical context.

> fine replacement for man-in-the-middle.  I didn't see an issue with

Except that hijacking/interception seem to be more easily implying an
easily discovered attack, whereas the main attack of concern are those
not discovered.

Cheers
    toerless

---

From: Stephan Wenger <[email-masked]>
Date: Thu, 20 Sep 2018 14:37:17 +0000

Hi Adrian, all,

I read Adrian's post with interest, and have two comments and one suggestion

1. I think Adrian may have had in mind the term "faggot" for bundle?  (My guess is that not many non-native English speakers can make that connotation; I just happened to get across a blog post the other day where I learned the source of that word.)  Going just slightly later into ancient English history, the term "faggot" was not only used for the bundle (of sticks or whatever), but also for the low-class peasant who carried the bundle; often a serf of some kind.  Perfect replacement for the non-PC word "Slave".
2. As the term "Master" may not be sufficient PC, and the English word "Leader" is, as other have pointed out, inadequate because good leaders actually are willing to discuss with their followers (and at least occasionally revise?) their decisions--which is counter-productive in protocol design--how about "Fuehrer"?  Fuehrer is a German word, and certainly Germany's most recent "Fuehrer" had very limited inclinations to discuss his decisions, or revise them... so a perfect match for the desired functionality.
3. Therefore I propose a "Fuehrer - Faggot" relationship.  

(For avoidance of doubt: no, this is not to be taken as a serious proposal.)

Stephan

On 9/20/18, 06:22, "ietf on behalf of Adrian Farrel" <[email-masked] on behalf of [email-masked]> wrote:

    

    Adrian

---

From: Mark Nottingham <[email-masked]>
Date: Thu, 20 Sep 2018 10:37:19 -0400

Hi Niels,

As my wife so often tells our kids, "manners cost nothing." 

Considering that the RFC series is archival and therefore our words will live for a long time, it's also prudent to be careful with our words. Consider how casual racism and sexism from even twenty years ago is perceived now.

So I think that this should be highlighted on the shepherd's checklist <https://www.ietf.org/iesg/template/doc-writeup-essay-style.html> -- e.g., "Is the terminology used in the draft unnecessarily specific to one culture, or potentially offensive?".

The RFC Editor might also want to make these considerations part of their process, in consultation with the stream managers.

Cheers,

> On 20 Sep 2018, at 5:25 am, Niels ten Oever <[email-masked]> wrote:
> 
> Hi all,
> 

--
Mark Nottingham   https://www.mnot.net/

---

From: Stephen Farrell <[email-masked]>
Date: Thu, 20 Sep 2018 15:39:44 +0100

> us from creating new problematic ones.

I'd be fine if someone wrote a draft that provided examples of
terms that are generally better avoided and guidance as to how
to do better with a focus perhaps on trying to find accurate
but descriptive terms. That could be fairly tricky to get right
and I'd guess contentious, but I don't see it being a problem
that someone wants to work on that. I'd read it anyway.

I'm not sure if it'd help or hinder such work, but I'd be happy
if such a draft included guidance on not using marketing terms
myself, like simple-foo, trusted-foo, cloud-foo and especially
cyber-foo. (I get very slightly offended sometimes when people
do that;-) If including such helped, the putative draft could
then be about doing better than badly chosen terms, and not only
about terms that may be considered offensive for historic or
other non-technical reasons.

S.

---

From: Melinda Shore <[email-masked]>
Date: Thu, 20 Sep 2018 06:50:14 -0800

> Thinking beyond my frustration with virtue signalling:

I'm not sure that it's helpful to suggest that there's no
actual substance to concerns about inadvertent offense
being caused by unthoughtful use of language, partly
because it's insulting and dismissive but primarily because
it's simply not accurate.

Melinda

---

From: [email-masked]
Date: Thu, 20 Sep 2018 08:04:52 -0700 (PDT)

> As my wife so often tells our kids, "manners cost nothing."

Sometimes they do:

  https://news.nationalgeographic.com/news/2013/07/130709-asiana-flight-214-crash-korean-airlines-culture-outliers/

There is a cost to political correctness. Even converations like this one have
a cost.

				Ned

---

From: Toerless Eckert <[email-masked]>
Date: Thu, 20 Sep 2018 17:19:07 +0200

> it's simply not accurate.

virtue signalling describes the condition where a proposed change
does not address or resolve real concerns but is just introduced
to suggest empathy and only accelerates the euphemism treadmill. 

Python: No slaves where saved in this revision of the language.

Toerless

---

From: Melinda Shore <[email-masked]>
Date: Thu, 20 Sep 2018 07:29:40 -0800

> to suggest empathy and only accelerates the euphemism treadmill. 

Yes, we're familiar with the terminology and how it's used.

Allow me to suggest that telling people their concerns aren't
"real" does not contribute to moving the discussion forward,
but rather the opposite.  What do you expect to *actually* result
from telling people that?  Try gaming this out, see where you
end up.

Melinda

---

From: Melinda Shore <[email-masked]>
Date: Thu, 20 Sep 2018 07:29:46 -0800

Melinda

---

From: "Paul Hoffman" <[email-masked]>
Date: Thu, 20 Sep 2018 08:32:39 -0700

> to suggest empathy and only accelerates the euphemism treadmill.

It's hard to tell if you are saying that the people on this thread who 
believe that using better language will resolve real concerns are wrong, 
or if you are accusing them of lying.

--Paul Hoffman

---

From: Evan Hunt <[email-masked]>
Date: Thu, 20 Sep 2018 17:09:39 +0000

> That said, I can't really see how the term "Man-in-the-middle" can be

I think the issue with "man-in-the-middle" isn't that it's offensive,
per se, but that the unnecessary use of gendered terminology tends to
reinforce mental biases.  In my lifetime in the US, we've largely shifted
from "fireman" and "mailman" and "stewardess" to "firefighter" and "mail
carrier" and "flight attendant" for similar reasons.  "Man-in-the-middle"
carries with it a subtle, unnecessary suggestion that the clever indivdual
between Alice and Bob is probably named Carl not Carol.

I confess I don't know whether there's a widely accepted non-gendered
term for it, but I would certainly use one if I knew it. Avoiding bias
neither hurts nor costs money.

-- 
Evan Hunt -- [email-masked]
Internet Systems Consortium, Inc.

---

From: Toerless Eckert <[email-masked]>
Date: Thu, 20 Sep 2018 19:17:06 +0200

> > > it's simply not accurate.

Obviously every case is different, but in the case of python, i can't
see how this helps slaves and as Steward nicely described the desired
semantic is quite well represented by the prior choice of language
(master/slave). 

> believe that using better language will resolve real concerns are wrong, or
> if you are accusing them of lying.

Its hard to tell if you suggest a choice of two bad reasons because you
want to be dismissive about my comments or because you can't think of any better
reasons.

To reiterate from my other email, IMHO:

a) Making computer terminology easier to understand for humans with different
cultural backgrounds and experiences is a good thing.
b) Changing language so no piece of computer/network hardware/software should
feel offended is not necessary.
c) Being culturally offended on behalf of a computer/network entity is 
virtue signalling. 

Cheers
    Toerless

---

From: Charlie Perkins <[email-masked]>
Date: Thu, 20 Sep 2018 10:20:45 -0700

Hello Evan,

How about "spy-in-the-middle"?

Regards,
Charlie P.

---

From: Evan Hunt <[email-masked]>
Date: Thu, 20 Sep 2018 17:33:52 +0000

> used only when *both* the primary and secondary had failed.

This suggests that at the time, you may have been under the impression
that the secondary server would be used only when the primary had failed?

For whatever it's worth, I think of it as concentric rings, with "primary"
referring to the center ring and "secondary" to the next ring out. Data
originates in the primary ring, and migrates to and through the secondary
ring, and we name the servers "primary" or "secondary" depending on which
ring they're in.

I never thought of "master" as having political or racial implications
(though, of course, as a white American guy, I do excel at overlooking
such things).  I thought of it as comparable to "master key".  But at some
point it crossed my mind that nobody ever talks about "slave keys", and if
the original choice of terminology had been so innocuous, then why don't
call them "master" and "copy"?  And then I started to see how these terms
could indeed come across as unwelcoming to people of some backgrounds.

And since "primary/secondary" works fine, I now try to use it, at least in
professional writing.  In casual conversation, old habits take longer to
break.

---

From: Melinda Shore <[email-masked]>
Date: Thu, 20 Sep 2018 09:39:01 -0800

> semantic is quite well represented by the prior choice of language

I don't think it's particularly difficult to find other terminology,
but I'll agree that the will to do so appears lacking.  Anyway, the
Python folk really are committed to building and diversifying their
community and are proactive about reaching out to people from
countries where human trafficking is a current and pressing problem.
I grew up in the US south and am old enough to have known the
children and grandchildren of slaves.  We are shown time after time
after time that universalizing our own experience leads us to make
some fundamental mistakes, as you do here.

I'm also really unclear on what you expect the outcome of replying
"No, you actually don't" to people who say "I care about <x>" will be.

Melinda

---

From: Evan Hunt <[email-masked]>
Date: Thu, 20 Sep 2018 17:42:56 +0000

> Looking forward to discuss.

This is a valuable topic, thank you for bringing it up.

IMHO the IETF should promte clear communication. The use of a term that's
likely be *perceived* as weighted by some readers -- even if the author
didn't intend it that way, and even if person who coined the term in the
first place didn't intend it that way -- can still hinder communication
with those readers. If it's easy to find an equivalent term without
the baggage, then it seems like common sense to use that term instead.

---

From: Michael StJohns <[email-masked]>
Date: Thu, 20 Sep 2018 13:52:44 -0400

> between Alice and Bob is probably named Carl not Carol.

Generically, there are some differences between the swap to non-gendered 
nouns and terms like man-in-the-middle.  The former reflects the 
reasonable desire to allow people to choose what they'll be called or 
how they're referred to - there are other examples that are obvious.   
But "man-in-the-middle" is just a term of art - one that's succinct and 
in our context unmistakable.

I'm concerned we're again off in the weeds here.  English has a lot of 
words with overloaded meanings and multiple definitions and others that 
do not. For example - whitelist and blacklist have pretty much singular 
meanings related to acceptance or rejection, while master has a 
bunch.    OED says blacklist goes back to at least 1619.  See a 
discussion on this about 10 years ago at 
http://garysaid.com/are-the-terms-whitelist-and-blacklist-racist/

Lastly, words can have cultural overlays that are not obvious. 
Continuing from Adrian's bundle of sticks, a similar word is a synonym 
for a cigarette and another similar word expression is a synonym for 
being tired.  The latter definition appearing around 1450 according to 
dictionary.com.

For better or for worse, we have our jargon (and invent it at dizzying 
rates with every RFC), we borrow jargon from related fields, and we base 
the remainder of text on established English (please don't use twerk in 
your RFC's!).    Let's not see shadows that have not yet overtaken us.   
And please - let's not require Heather and the RFC folks to become our 
word conscience.

If you feel strongly about this AND you're authoring a draft or RFC - by 
all means, wordsmith to your hearts content.  Please use words that lead 
to only one meaning in context where those words are necessary and try 
not to invent new ones.

Later, Mike

---

From: Dave Aronson <[email-masked]>
Date: Thu, 20 Sep 2018 14:08:47 -0400

> How about "spy-in-the-middle"?

Monkey in the middle?

-- 
Dave Aronson, Software Development Consultant
The T. Rex of Codosaurus, LLC
(http://www.Codosaur.us)
What can we help you evolve today?

---

From: Heather Flanagan <[email-masked]>
Date: Thu, 20 Sep 2018 11:14:46 -0700

>> On Sep 20, 2018, at 10:52, Michael StJohns <[email-masked]> wrote:
>> 
> Generically, there are some differences between the swap to non-gendered nouns and terms like man-in-the-middle.  The former reflects the reasonable desire to allow people to choose what they'll be called or how they're referred to - there are other examples that are obvious.   But "man-in-the-middle" is just a term of art - one that's succinct and in our context unmistakable.
> 
> I'm concerned we're again off in the weeds here.  English has a lot of words with overloaded meanings and multiple definitions and others that do not. For example - whitelist and blacklist have pretty much singular meanings related to acceptance or rejection, while master has a bunch.    OED says blacklist goes back to at least 1619.  See a discussion on this about 10 years ago at http://garysaid.com/are-the-terms-whitelist-and-blacklist-racist/
> 
> Lastly, words can have cultural overlays that are not obvious. Continuing from Adrian's bundle of sticks, a similar word is a synonym for a cigarette and another similar word expression is a synonym for being tired.  The latter definition appearing around 1450 according to dictionary.com.
> 
> For better or for worse, we have our jargon (and invent it at dizzying rates with every RFC), we borrow jargon from related fields, and we base the remainder of text on established English (please don't use twerk in your RFC's!).    Let's not see shadows that have not yet overtaken us.   And please - let's not require Heather and the RFC folks to become our word conscience.

I can only imagine the possible discussions between the editors and authors, given the heated debates now over ‘simple’ terms like that versus which.

I’m glad the community is having this conversation, because any changes to the use of terms and language in an RFC must come from the community. I don’t think it can reasonably be imposed by the editors. Not unless we significantly change the relationship between the RFC Editor and the authors.

-Heather

> 
> If you feel strongly about this AND you're authoring a draft or RFC - by all means, wordsmith to your hearts content.  Please use words that lead to only one meaning in context where those words are necessary and try not to invent new ones.
> 
> Later, Mike
> 
> 
> 
> 
> 
>

---

From: Mark Nottingham <[email-masked]>
Date: Thu, 20 Sep 2018 14:27:16 -0400

> On 20 Sep 2018, at 2:14 pm, Heather Flanagan <[email-masked]> wrote:
> 

It obviously won't work as an adversarial relationship (e.g., the RFC editor "enforcing" a rule), and I don't think anyone has suggested that. 

Is it reasonable to mention this as something to think about when you're authoring / reviewing a draft, and have a discussion as adults if someone thinks a term might have such an issue?

If not, why? Noticing potential issues and discussing their resolution seems pretty bread-and-butter around here IME.

Cheers,

---

From: Heather Flanagan <[email-masked]>
Date: Thu, 20 Sep 2018 11:33:16 -0700

> On Sep 20, 2018, at 11:27, Mark Nottingham <[email-masked]> wrote:
> 
> 
> 

I did read the suggestion initially as maintaining and helping enforce a list of words/terms, which I’m definitely uncomfortable with.

> Is it reasonable to mention this as something to think about when you're authoring / reviewing a draft, and have a discussion as adults if someone thinks a term might have such an issue?

Sure, and we do that now. Though it happens that authors get upset when questioned about word choice; we deal with it, but it happens.

> If not, why? Noticing potential issues and discussing their resolution seems pretty bread-and-butter around here IME.

I think you and I are considering this at different places on a continuum. Asking if something is potentially awry, yes, of course (while being sad that this wasn’t questioned sooner in the process). Maintaining a list of possibly inappropriate words and enforcing their review, which implies accountability for the list, that I’m not comfortable with.

-Heather

---

From: Evan Hunt <[email-masked]>
Date: Thu, 20 Sep 2018 18:57:21 +0000

> c) Being culturally offended on behalf of a computer/network entity is 

If you believed that the intention of the change was to avoid hurting the
feelings of computers, as opposed to the people using those computers,
then let me gently suggest you may have missed the point.

---

From: Carsten Bormann <[email-masked]>
Date: Thu, 20 Sep 2018 21:10:51 +0200

On 20. Sep 2018, at 19:52, Michael StJohns <[email-masked]> wrote:
> 
> But "man-in-the-middle" is just a term of art - one that's succinct and in our context unmistakable.

The up-to-date term of art is “middleperson attack” (oh my, Janus attack would have been so much better).
It’s even a syllable shorter.  I have noticed people often can be seen smirking slightly when they say this.

Just in case people don’t know, I’m (very mildly) offended if someone calls me (or any other human) a “person”, except of course for those who are just that.
(There is a bit more cultural background involved here than I would want to discuss on this list.)
Now deal with that :-)

Grüße, Carsten

---

From: Ted Lemon <[email-masked]>
Date: Thu, 20 Sep 2018 15:30:49 -0400

> Just in case people don’t know, I’m (very mildly) offended if someone calls me (or any other human) a “person”, except of course for those who are just that.

I think that there's a tremendous lack of clarity about what's being discussed here that is worth stating more explicitly.

The issue is not that someone might get offended.   It's impossible to never give offense.   Nobody is proposing, as far as I know, that the IETF enforce some set of rules intended to produce this impossible result.   The issue is also not "politics," unless you think the wish not to have to work in a hostile work environment is political.   What we are talking about is something different.

Consider this: there are words in the modern vernacular the use of which is actually hurtful, and not merely offensive.   The reason it's hurtful is because it causes an individual sensitized to the use of that word to revisit an ongoing oppression under which that person is suffering.   People who enjoy engaging in such oppression may use these words in a professional context in the hopes of creating suffering for their co-worker who is part of an oppressed group.   An example of this would be the use of the "n-word" or the use of the "c-word."   (If you don't know what I'm talking about, please ask me privately and not here on the list).

There are contexts in which the use of these words is acceptable, but I think most if not all people here would agree that there is never a time where these words should be used either in IETF discussions or in IETF standards.   So that's the extreme.

Then there are words for which there isn't any such association.   For example, I don't think we are in any danger of having to redact the word "packet" from any RFCs.

So those are two extremes to think of.   Now of course, the set of terms that are on the bad extreme varies from country to country and from language to language.   RFCs are in English, so we can somewhat ignore the language, although there might be cases where a perfectly fine english word means something in another language that sends it over to the bad extreme.

I think, and of course I may be wrong, that terms like "blackballed," "blacklist," "whitelist," and so on, are probably not down at the bad end of the spectrum, although I'm certainly willing to entertain the possibility that I am wrong, since I am not an affected party.   But words like "master" and "slave," particularly when used together, definitely seem to be at least toward the bad end of the continuum, and definitely not at the okay end where words like "packet" live.

So the question we ought to be talking about is whether there are words that we habitually use in the IETF that might now, or might in the future, be considered to be as abusive as the n-word and the c-word, or might be used in that way.   If we have reason to believe that such words are in use, it would be wise for us to find different words to use.   This will save us trouble in the long run.

Arguing that we ought not to have to change our use of such words because they are understood to have some non-abusive meaning misses the point; there may have been a time when discrimination against the affected population was so pervasive that there was nobody to complain about the problem, or nobody who could safely complain about it.   And for those not in the affected population, it had no loaded meaning and therefore seemed like a perfectly reasonable metaphor to use.   That pre-existing and blameless motivation does not make it okay to continue using the term now, assuming that we care to address the known problems of non-inclusiveness in our profession.

---

From: Toerless Eckert <[email-masked]>
Date: Thu, 20 Sep 2018 21:45:41 +0200

On Thu, Sep 20, 2018 at 09:39:01AM -0800, Melinda Shore wrote:
> but I'll agree that the will to do so appears lacking. 

The question is also always how to usefully address
sensibilities/problems, and doctoring with language just
has a tradition of being done instead of more effective means
of addressing them.

>  Anyway, the

Sure. And you really think that this change in python is at least
perceived as a useful ? I fear it would be perceived cynical as
just a theater because it does not really help the matter.

> some fundamental mistakes, as you do here.

I guess in this case i am probably arguing from an absence of
an eperience with slavery, while you may be universalizing your
experience with it.

I am always happy about crisp examples how some proposal does actually
help. I have not seen this for the master/slave case.

> "No, you actually don't" to people who say "I care about <x>" will be.

Calling out virtue signaling is not denying that someone cares,
just that its not helping.

Cheers
    Toerless

-- 
---
[email-masked]

---

From: Evan Hunt <[email-masked]>
Date: Thu, 20 Sep 2018 19:46:22 +0000

On Thu, Sep 20, 2018 at 09:10:51PM +0200, Carsten Bormann wrote:
> The up-to-date term of art is “middleperson attack”

Perhaps "on-path attack".

---

From: Carsten Bormann <[email-masked]>
Date: Thu, 20 Sep 2018 21:56:34 +0200

> On 20. Sep 2018, at 21:46, Evan Hunt <[email-masked]> wrote:
> 
> Perhaps "on-path attack”.

No, that includes attacks where you are on path just to listen in.
(“spy-in-the-middle attack” has the same problem.)

That’s why I like Janus attack — middleperson attacks are about giving one face to one end and a different face to the other end.  Unfortunately, there is this guy Mark Janus…

Middleperson attack it is.  I’m amazed that Wikipedia doesn’t know that...

Grüße, Carsten

---

From: John C Klensin <[email-masked]>
Date: Thu, 20 Sep 2018 15:57:32 -0400

Two quick observations that I don't think have been made already
in favor of being much more careful about terminology we
introduce in the future but probably letting most existing and
well-established terminology stand.

(1) To further illustrate the difficulties in trying to prohibit
terms that someone would find offensive, even those who are
inclined to look for things to be offended about (a category
that I am confident includes no IETF participants), it is
possible to construe "client/server" (and "server" in
particular) and "protocol" in ways that would make them
offensive. Lloyd has already identified "whitespace" and some
specifications we don't control (parts of the Unicode collection
come to mind) are target-rich environments.  It seems to me that
this is a slippery slope at a very high angle.  We could, of
course, go through existing terms one by one and try to reach
community consensus about what to do about each one, but let's
try to remember that even having the discussion we are already
having is quite expensive for the community in terms of other
work that doesn't get done.  It is also hard work.  As an
example, I've always found "man-in-the-middle" terminology
problematic, but at least as much because it implies human
intervention rather than something more automated as because of
gender.  Yes, there is a gender issue, but
"monkey-in-the-middle" or even "donkey-in-the-middle" are still
problematic.   "Agent-in-the-middle" or maybe the "spy"
suggestion (but that may have the wrong implications too -- not
because there are no women spies but because, in many language
contexts, the term implies observing and not intervening), might
be better, but...

(2) There isn't any starting from a clean slate as of today (or
any other convenient date).   If there is a term that we have
been using as a term of art for some time and we decide to
substitute a newer and better one, existing documents --our RFCs
and tutorials, manuals, etc., written by others-- aren't going
to change.  So, unless the relationship between the earlier
terms and the later ones are completely obvious, everyone is
going to need a glossary that maps both ways between the new
ones and that older ones and explains any non-exact mappings.
What is "obvious" to one person may not be to another: using the
monkey example again, if "monkey-in-the-middle" shows up in a
document in a context in which "man-..." would have been
expected earlier, clearly one possibility is that the authors
were trying to use less problematic language.  However, if even
a few people wonder whether the new term is intended to identify
a difference in circumstances or protocol relationships (not
just substitution of less problematic terminology), the costs to
the community and the clarity of our specifications are actually
very high.

  best,
    john

p.s. I agree with Mike St. Johns's note too and don't feel a
need to repeat it but let me add a pair of closely-related
suggestions about his conclusion.   First, if you want to
introduce newer and better terminology, make sure you do it
before IETF Last Call and don't try to slip it in at AUTH48.
The latter would be unfair to the community and risks
introducing subtle changes for which there is no consensus (that
is another reason why trying to pass responsibility for this
onto the RFC Editor is a bad idea).  And, second, if you are
introducing new terms to substitute for older ones, please call
that out (in introductory material in the document and in IETF
Last Call) and explain what you are doing so as to mitigate some
of the difficulties described above.

---

From: Carsten Bormann <[email-masked]>
Date: Thu, 20 Sep 2018 22:00:17 +0200

On 20. Sep 2018, at 21:30, Ted Lemon <[email-masked]> wrote:
> hurtful

Thanks — much more clarity indeed.

Grüße, Carsten

---

From: Toerless Eckert <[email-masked]>
Date: Thu, 20 Sep 2018 22:11:36 +0200

> then let me gently suggest you may have missed the point.

Do i qualify to demand a rename of https://en.wikipedia.org/wiki/Fat_tree
if i have an appropriate BMI and feel offended or do i have to work in
a Data Center ? Or can i simply demand it with the argument that obesity
kills a lot more people than slavery, and the richest companies on the planet
are promoting it by their choice of network technologies.

Cheers
    Toerless

---

From: Anton Ivanov <[email-masked]>
Date: Thu, 20 Sep 2018 21:12:56 +0100

On 20/09/18 18:52, Michael StJohns wrote:
> Generically, there are some differences between the swap to
> non-gendered nouns and terms like man-in-the-middle.  

They are also language dependent.

In a language where nearly anything inanimate is supposed to have no
gender, assigning a gender to something is a big deal. An excellent
example is the issue some people have with a ship being "she" in English.

In a language where nearly anything inanimate has ended up with either
female or male grammatic gender - not so much.

If I put one of my several "native level speaker of a language in the
second category" hats on, some parts of the discussion as well as
various changes and practices mentioned so far (f.e. avoiding the word
manned spaceflight and calling it crewed) look distinctly like a storm
in a teacup and much ado about nothing.

IMHO, it does not matter what we do, someone somewhere will be offended.
We might as well live with it and not waste efforts on exceptional
political correctness. Sure, trying to be reasonably politically correct
in new work is fine.

Going back, rewriting all of the terminology, editing existing
documents, etc? Especially for something which is an major issue in just
one of the several hundred languages on the planet? Excuse me, but did
we run out of things where we can be really useful so that we have to
find ourselves time fillers like this?

A.

> The former reflects the reasonable desire to allow people to choose
> what they'll be called or how they're referred to - there are other
> examples that are obvious.   But "man-in-the-middle" is just a term of
> art - one that's succinct and in our context unmistakable.
>
> words with overloaded meanings and multiple definitions and others
> that do not. For example - whitelist and blacklist have pretty much
> singular meanings related to acceptance or rejection, while master has
> a bunch.    OED says blacklist goes back to at least 1619.  See a
> rates with every RFC), we borrow jargon from related fields, and we
> base the remainder of text on established English (please don't use
> twerk in your RFC's!).    Let's not see shadows that have not yet
> overtaken us.   And please - let's not require Heather and the RFC
> folks to become our word conscience.
>
> If you feel strongly about this AND you're authoring a draft or RFC -
> by all means, wordsmith to your hearts content.  Please use words that
> lead to only one meaning in context where those words are necessary
> and try not to invent new ones.
>
> Later, Mike
>
>
>
>
>
>
>

---

From: Yoav Nir <[email-masked]>
Date: Thu, 20 Sep 2018 23:36:47 +0300

> On 20 Sep 2018, at 22:56, Carsten Bormann <[email-masked]> wrote:
> 
> 
> That’s why I like Janus attack — middleperson attacks are about giving one face to one end and a different face to the other end.  

I don’t think we are promoting inclusiveness by resorting to obscure mythology, any more than by using Star Trek references, Dr Who references, or Monty Python references [1]

There is a lot of value in being consistent in terminology between old and new documents, and with terms of art that are well-known throughout the world. It may say something bad about human society, but terms like “master” and “slave” are well understood throughout the world. The association of the colors black and white are less culturally universal, but everyone who has worked with a spam filter or with routing is well aware of these terms.

Making up new terms based on very specific cultural references or the sensitivities of the day are bad for clarity and make our documents less useful.  Blacklist is a word. You can look it up in a dictionary. “Allowlist” or “permitlist” are neologisms. Yes, I can figure out what they mean, but I shouldn’t have to.

Yoav

[1] https://tools.ietf.org/html/rfc7725#section-3

---

From: Kyle Rose <[email-masked]>
Date: Thu, 20 Sep 2018 16:40:31 -0400

If I had to state a position, it would be that our interest as engineers is
in using clear language. Often, this means established language whose
domain-specific meanings remain static as definitions in different domains
drift over time. Authors can make what word choices they like to achieve
clarity, leaving room for individuals to use language they find less loaded
or overloaded or baggage-carrying. Folks who want to help them are welcome
but the IETF has no interest in legislating language that will degrade
clarity.

Kyle

---

From: Brian E Carpenter <[email-masked]>
Date: Fri, 21 Sep 2018 08:57:41 +1200

> It seems to work for them for quite a while already.

No. Master/slave, whether we like it or not, implies that A gives orders
and B has no choice but to obey them. Leader/follower doesn't have that
strength. (However, in most cases it's sufficient to name the master
but use no special name for the other nodes.)

IMHO, the only sane outcome is to use common sense as well as avoiding
clearly offensive terms. That means, to me, that master/slave and
man-in-the-middle (for example) are OK, and so are Alice, Bob and Eve
in security analysis.

Blacklist/whitelist is slightly tricky - I suppose the most PC solution
would be redlist/greenlist.

I think that one sentence in the Tao and the RFC style guide would
take care of this topic. "Don't use offensive words but apply common
sense in using 'politically correct' language."

    Brian

---

From: Carsten Bormann <[email-masked]>
Date: Thu, 20 Sep 2018 22:59:43 +0200

On 20. Sep 2018, at 22:57, Brian E Carpenter <[email-masked]> wrote:
> 
> "Don't use offensive words but apply common

You lose: “politically correct” is offensive.

Grüße, Carsten

---

From: Dave Cridland <[email-masked]>
Date: Thu, 20 Sep 2018 22:34:11 +0100

> that the secondary server would be used only when the primary had failed?
Yes, that is exactly what I thought at the time, based on the terms.

> professional writing.  In casual conversation, old habits take longer to

My point was that primary/secondary really didn't work for me.

I quite like Tony Finch's suggestion of "master/replica" though, for DNS in
particular.

---

From: Ted Lemon <[email-masked]>
Date: Thu, 20 Sep 2018 17:39:58 -0400

On Sep 20, 2018, at 4:11 PM, Toerless Eckert <[email-masked]> wrote:
> Do i qualify to demand a rename of https://en.wikipedia.org/wiki/Fat_tree <https://en.wikipedia.org/wiki/Fat_tree>
> a Data Center ?

Toerless, let me put it to you this way: are you having a problem at work that is sufficient that you feel that you would like to report it to your human resources/personnel department as harassment, but you don't feel safe in doing so?   If so, and if what you are experiencing is being enabled by some terminology used in the IETF, then what you are saying would apply.   Otherwise you are just wasting our time asking this question.   This is not a Kaffee Klatsch, and we are not talking about this for fun.

https://en.wikipedia.org/wiki/Hostile_work_environment <https://en.wikipedia.org/wiki/Hostile_work_environment>

---

From: "John Levine" <[email-masked]>
Date: 20 Sep 2018 19:34:39 -0400

>that is offensive to some people and groups is quite common.

If this is really the best that HRPC can do, I would suggest that it's
time for the IRTF to consider whether to shut it down.

When I've gone to HRPC sessions, I have heard endless papers about
more or less plausible threats to freedom of expression or to
anonymous speech (which is not the same thing.)  More than once I have
stood up at HRPC sessions and noted that the Universal Declaration of
Human Rights has thirty articles, and none of the discussion deals
with more than two of them.  The chairs have assured me that they are
equally interested in the other rights, but the evidence of that is
pretty thin.

What about article 12, protection agaisnt attacks on honor and
repuation?  What is HRPC doing about trolling and other online
attacks?

Or article 17, nobody shall be arbitrariy deprived of his property?
What is HRPC doing to keep our protocols from being used to enable
phishing and other online theft?

Or article 23, the right to rest and leisure?  What is HRPC doing to
keep our protocols from being used to put people on a 24 hour
electronic leash?

Instead, we get this stuff.  Even if you think that the language in
our RFCs is problematic, which for the most part I don't, I am
confident that no RFC has ever enslaved anyone, nor put anyone on a
secret list that kept them from working (the actual meaning of
blacklist for people who know their history.)

There are real human rights problems that HRPC could engage with, but
don't.  They need to make up their mind whether they're serious.

R's,
John

---

From: Toerless Eckert <[email-masked]>
Date: Fri, 21 Sep 2018 01:44:51 +0200

Ted,

Your attempt at trying to characterize problematic words with
"hurtfull" is useful. Asking for the discussion to be limited
to people personally affected is not so useful. And trust me,
its not fun to question the effectiveness and efficiency of
well meaning initiatives. 

I brought up "fat" as a well known example of abuse in hostile
work environments that i assume most on this thread could
easier relate to than slavery (fat shaming). Makes it IMHO
easier to imagine how language management can not really
help directly with hostile work environments.

I really don't think that pythons change can help with any
hostile work environments either. The best benefit i can think of
is relief for the poor teacher in school/college of an affected
country who really does not need a discussion about slavery when
teaching a 101 computer course in python. Nor the support for
playfull passive-aggressive behavior when students start
programming with a a derogatory-rich vocabulary.

Cheers
    Toerless

-- 
---
[email-masked]

---

From: Ted Lemon <[email-masked]>
Date: Thu, 20 Sep 2018 20:35:04 -0400

My point is that the reference you were making was not an IETF document,
and as far as I know nobody has complained about it.   This discussion was
triggered by actual complaints by actual people, and the terms about which
the complaints were made are used in IETF standards; this is why it's a
matter of interest.

I'm not suggesting that the discussion be limited to those who've been
personally affected; in that case I certainly would have no standing to
comment.   What I'm saying is that this really is a serious discussion that
affects real people in meaningful ways, and you seemed to be trivializing
it.   I'm sorry if I misunderstood.

On Thu, Sep 20, 2018 at 7:44 PM Toerless Eckert <[email-masked]> wrote:

> > > Do i qualify to demand a rename of
> https://en.wikipedia.org/wiki/Fat_tree <
> https://en.wikipedia.org/wiki/Fat_tree>
> > Toerless, let me put it to you this way: are you having a problem at
> work that is sufficient that you feel that you would like to report it to
> your human resources/personnel department as harassment, but you don't feel
> safe in doing so?   If so, and if what you are experiencing is being
> enabled by some terminology used in the IETF, then what you are saying
> would apply.   Otherwise you are just wasting our time asking this
> question.   This is not a Kaffee Klatsch, and we are not talking about this
> for fun.
> >
> > https://en.wikipedia.org/wiki/Hostile_work_environment <
> https://en.wikipedia.org/wiki/Hostile_work_environment>
> >
>
> --
> ---
> [email-masked]
>

---

From: Brian E Carpenter <[email-masked]>
Date: Fri, 21 Sep 2018 14:00:33 +1200

> You lose: “politically correct” is offensive.

Well, perhaps that's why I put it in quotes. I'm not quite
sure what is the inoffensive way to describe absurd usage.
Do I need a **TRIGGER WARNING** before suggesting that...
(well, I won't finish that sentence.)

    Brian

---

From: Mark Rousell <[email-masked]>
Date: Fri, 21 Sep 2018 03:18:09 +0100

On 20/09/2018 18:42, Evan Hunt wrote:
>  The use of a term that's likely be *perceived* as weighted by some
> readers -- even if the author didn't intend it that way, and even if
> person who coined the term in the first place didn't intend it that
> way -- can still hinder communication with those readers.
[...]
> If it's easy to find an equivalent term without the baggage, then it
> seems like common sense to use that term instead. 

Reasonable common sense to my mind is to use clear, established,
industry standard terminology and for people with baseless perceptions
that such terminology is somehow aimed at them to learn that the context
matters (i.e. that contextually relevant usage of certain terms is not
"weighted" or negative in any way whatsoever).

-- 
Mark Rousell

---

From: Mark Rousell <[email-masked]>
Date: Fri, 21 Sep 2018 03:10:46 +0100

> don't.  They need to make up their mind whether they're serious.

Well said.

-- 
Mark Rousell

---

From: Melinda Shore <[email-masked]>
Date: Thu, 20 Sep 2018 18:29:59 -0800

>> don't.  They need to make up their mind whether they're serious.

Here's the current list of drafts, plus some contributions
that haven't been adopted by the RG:
https://datatracker.ietf.org/rg/hrpc/documents/

Melinda

---

From: Alia Atlas <[email-masked]>
Date: Thu, 20 Sep 2018 22:31:59 -0400

On Thu, Sep 20, 2018 at 10:18 PM Mark Rousell <[email-masked]>
wrote:

> readers -- even if the author didn't intend it that way, and even if person
> who coined the term in the first place didn't intend it that way -- can
> still hinder communication with those readers.
>
> [...]
>
> If it's easy to find an equivalent term without the baggage, then it seems
> like common sense to use that term instead.
>
>
> Reasonable common sense to my mind is to use clear, established, industry
> standard terminology and for people with baseless perceptions that such
> terminology is somehow aimed at them to learn that the context matters
> (i.e. that contextually relevant usage of certain terms is not "weighted"
> or negative in any way whatsoever).
>

While I do agree with John Levine that there are many additional human
rights and issues to consider,
I don't see how one can disregard the origins of "blacklist".  These don't
sound neutral - and saying it is industry standard is
another way of saying "keep out" to those impacted or that they must deal
with the stereotypes and unpleasant reminders.

 WE invent what becomes industry standard terminology - and  given that the
next challenge is growing the Internet to the next
billion people, whom will come from different cultures, countries, and
backgrounds - taking a few moments for a descriptive and thoughtful
term isn't a lot to ask.

Please consider if you have ever had a term or terminology that disturbs or
bothers you.
Here's another trivial one - people using "guys" instead of "folks" - each
use serves to remind women that they are the
exception or allowed because their gender doesn't matter.

Being inclusive is about being welcoming and not merely not deliberately
hostile.  To grow the technical community in diversity and
including many viewpoints to handle new technical challenges as more folks
join the Internet, this matters.

Regards,
Alia

--

---

From: Allison Mankin <[email-masked]>
Date: Thu, 20 Sep 2018 22:38:29 -0400

Thanks for sharing the draft list, Melinda.  I'm also adding the chairs in
case they want to chime in.  There
is some work in planning that hasn't been drafted yet.

I think that people should not consider this discussion on IETF discuss as
a representation of the group.
I support the general discussion, but the HRPC work is extensive, and
there's no good reason to discuss it
at length outside of its own mailing list (subscription link:
https://www.irtf.org/mailman/listinfo/hrpc)

Finally, if anyone wants to start drafts on Human Rights articles not
already tackled, that door is open.

Allison

---

From: Mark Rousell <[email-masked]>
Date: Fri, 21 Sep 2018 04:05:35 +0100

On 21/09/2018 03:31, Alia Atlas wrote:
> I don't see how one can disregard the origins of "blacklist".

What are the origins? I've used the term for decades in many contexts
but never, ever needed to know or care what its origins are. I still
need to know or care. It's completely and wholly irrelevant to current
usage.

> These don't sound neutral

I just looked at Wikipedia and it states that "The English dramatist
Philip Massinger used the phrase "black list" in his 1639 tragedy The
Unnatural Combat."

I can't say that I see anything there that could or should bother any
reasonable person.

And this rather highlights the fundamental absurdity of this sort of
fretting over words (specifically words that are not directed against
any human being in current industry usage). It doesn't matter in the
slightest what the origin of a word is. Indeed, people often disagree
over origins. All that actually matters is how a word is used in context
now. And, as such, "blacklist" has a useful, practical meaning in the
context of listing things to be avoided. It is completely harmless,
completely non-prejudicial, and completely inoffensive in its contextual
usage.

> and saying it is industry standard is 
> another way of saying "keep out" to those impacted or that they must
> deal with the stereotypes and unpleasant reminders.

You joke, surely. Saying that something is "industry standard" is just
that. There is no "keep out", neither implicit nor explicit. Any such
interpretation is unreasonably self-centred and incorrect. Terminology
is a shorthand that people use to facilitate clear communication,
nothing more and nothing less.

The key point of industry standard terminology is that there are no
"stereotypes and unpleasant reminders". How can there be? Industry
standard terminology is, by its absolutely fundamental nature, not
directed against any individual. It is about technology, about things,
not people. To make it about people is to misinterpret it.

>  WE invent what becomes industry standard terminology - and  given
> that the next challenge is growing the Internet to the next

I agree. But that's no reason to uninvent historical terms that have
established, clear, industry meaning. Furthermore, just as we wish to
take the Internet to new people, it is only reasonable that those new
people expand their horizons to accept what was there before them. I had
to do this, other people had to do this, and it is only reasonable to
expect other people to do the very same thing.

> Please consider if you have ever had a term or terminology that
> disturbs or bothers you.

No, I haven't. When I approach a new area of knowledge, I accept that it
brings its own terminology. I am adult enough to not take any of it
personally.

Of course, if people say something personal then that's different. But
genuinely industry terminology can never be personal.

> Here's another trivial one - people using "guys" instead of "folks" -
> each use serves to remind women that they are the

"Guys" or "Folks" (which, as an aside, is commonly seen as a rather
annoying and jarring phrase where I am) are not industry standard
terminology.

> Being inclusive is about being welcoming and not merely not
> deliberately hostile.

That's an interesting view. To my mind, being "inclusive" is all about
allowing *everyone* to join in on their own terms. When I say "everyone"
I meant that: It applies as much to those who have have already joined
in as well as newcomers. As such, there is no good reason to dismiss
clearly understood industry standard terminology. Such terminology is,
by its fundamental nature, neutral. It shuts no one out unless they
*choose* to be shut out for artificial reasons. Why should established
and well understood terminology be changed just to suit a minority of
newcomers who cannot or will not adapt? I think that would be
unreasonable and would fail the inclusiveness test by alienating those
who have already adapted. Remember, inclusiveness is for everyone, not
just newcomers.

> To grow the technical community in diversity and
> including many viewpoints to handle new technical challenges as more
> folks join the Internet, this matters.

Terminology is just terminology. It does not any in genuine way
whatsoever preclude new people or new viewpoints. It just allows
everyone, old and new, to communicate clearly in a neutral manner that
is not prejudicial against anyone.

-- 
Mark Rousell

---

From: Mark Rousell <[email-masked]>
Date: Fri, 21 Sep 2018 04:07:58 +0100

On 21/09/2018 04:05, Mark Rousell wrote:
>> While I do agree with John Levine that there are many additional
>> human rights and issues to consider,

s/I still need to know or care/I still don't need to know or care/

-- 
Mark Rousell

---

From: Mark Rousell <[email-masked]>
Date: Fri, 21 Sep 2018 04:34:10 +0100

> annoying and jarring phrase where I am) are not industry standard

Although "folks" has nothing to do with industry standard terminology of
any sort, I mentioned as an aside that it is commonly seen as a rather
annoying and jarring phrase where I am. I said this merely to note it as
an aside. I'd never actually complain about it, no matter how annoying I
might find it. The reason I would not complain about it is because I am
not so selfish or self-centred as to expect other people to change their
culture to suit me. As an adult, I accept that I can adapt to work with
their culture (if I work within it, join it, live with it or communicate
with it), even if some of their phraseology might privately annoy me.

In the parallel context of industry terminology, for a newcomer to a
particular industry to get upset over certain well established industry
standard terms is making a mistake: They are making the mistake of
thinking that it's all about them when, in fact, the usage of the terms
that bother them (if any) are nothing whatsoever to do with them (just
as the use of "folks" would not be aimed at me)! The industry terms are
entirely neutral terms, used only because they have clearly understood
meaning in that industry. Joining the industry means, amongst other
things, learning the terminology and learning not to take it personally
when it is in reality entirely non-personal. Industry terminology really
is just neutral, non-harmful communication. Learning it is part of
education and adaptation as an adult. In short, no one should expect the
mass of people to adapt to you just because it's you; try instead to
adapt to the already existing standards that everyone else has been able
to adapt to, standards that are not in any way whatsoever shutting you
out (since any words you don't like are not aimed at you at all) and
which are fully inclusive to everyone involved in the industry, both old
and new, not just you.

-- 
Mark Rousell

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Fri, 21 Sep 2018 00:22:09 -0400

Some thoughts

1) I strongly agree that there are some words to be avoided. Slave for
example. I always refer to DNS servers as either Master/Subordinate or
Master/Copy

2) Master is from the Latin Magister meaning chief. I don't see a problem
with it unless people are going to use the term slave as well.

3) Since the man in the middle is always up to no good, I don't see that we
need to change that vocabulary. Yes, women can be supervillains too.

If you recall, Alice and Bob used to interact with a chap called Mallory.
Why did we switch to Mallet, well a person whose last name is Mallory
started going to some crypto reading groups at MIT.

The etymology of blacklist is difficult to say the least as the first
appearance in printed text is not necessarily when it entered the
vernacular. That point is probably the list of regicides and others in the
Indemnity and Oblivion act of 1660. Finding a relative listed there is
rather more prestigious than having one allegedly sail on the Mayflower.

---

From: Lloyd Wood <[email-masked]>
Date: Fri, 21 Sep 2018 04:33:45 +0000 (UTC)

"Since the man in the middle is always up to no good,"

TCP accelerators for satellite; email relaying, DNS resolvers

that aren't root name servers...

intermediaries are often there for good helpful reasons.

L.

Female supervillains? What, Ayn Rand?
Lloyd Wood [email-masked] http://about.me/lloydwood 

________________________________
From: Phillip Hallam-Baker <[email-masked]>
To: Mark Rousell <[email-masked]> 
Cc: IETF Discussion Mailing List <[email-masked]>
Sent: Friday, 21 September 2018, 14:22
Subject: Re: Diversity and offensive terminology in RFCs

Some thoughts

1) I strongly agree that there are some words to be avoided. Slave for example. I always refer to DNS servers as either Master/Subordinate or Master/Copy

2) Master is from the Latin Magister meaning chief. I don't see a problem with it unless people are going to use the term slave as well.

3) Since the man in the middle is always up to no good, I don't see that we need to change that vocabulary. Yes, women can be supervillains too.

If you recall, Alice and Bob used to interact with a chap called Mallory. Why did we switch to Mallet, well a person whose last name is Mallory started going to some crypto reading groups at MIT.

The etymology of blacklist is difficult to say the least as the first appearance in printed text is not necessarily when it entered the vernacular. That point is probably the list of regicides and others in the Indemnity and Oblivion act of 1660. Finding a relative listed there is rather more prestigious than having one allegedly sail on the Mayflower.

---

From: Lloyd Wood <[email-masked]>
Date: Fri, 21 Sep 2018 04:34:58 +0000 (UTC)

'"Guys" or "Folks" (which, as an aside, is commonly seen as a rather annoying and jarring phrase where I am)'
Oh, agreed. 'Folks' means I'm about to be patronised by an American. Lloyd Wood [email-masked] http://about.me/lloydwood 

      From: Mark Rousell <[email-masked]>
 To: [email-masked] 
 Sent: Friday, 21 September 2018, 13:35
 Subject: Re: Diversity and offensive terminology in RFCs

 
   Here's another trivial one - people using "guys" instead of "folks" - each use serves to remind women that they are the exception or allowed because their gender doesn't matter.   
 
 "Guys" or "Folks" (which, as an aside, is commonly seen as a rather annoying and jarring phrase where I am) are not industry standard terminology.

 Although "folks" has nothing to do with industry standard terminology of any sort, I mentioned as an aside that it is commonly seen as a rather annoying and jarring phrase where I am. I said this merely to note it as an aside. I'd never actually complain about it, no matter how annoying I might find it. The reason I would not complain about it is because I am not so selfish or self-centred as to expect other people to change their culture to suit me. As an adult, I accept that I can adapt to work with their culture (if I work within it, join it, live with it or communicate with it), even if some of their phraseology might privately annoy me.
 
 In the parallel context of industry terminology, for a newcomer to a particular industry to get upset over certain well established industry standard terms is making a mistake: They are making the mistake of thinking that it's all about them when, in fact, the usage of the terms that bother them (if any) are nothing whatsoever to do with them (just as the use of "folks" would not be aimed at me)! The industry terms are entirely neutral terms, used only because they have clearly understood meaning in that industry. Joining the industry means, amongst other things, learning the terminology and learning not to take it personally when it is in reality entirely non-personal. Industry terminology really is just neutral, non-harmful communication. Learning it is part of education and adaptation as an adult. In short, no one should expect the mass of people to adapt to you just because it's you; try instead to adapt to the already existing standards that everyone else has been able to adapt to, standards that are not in any way whatsoever shutting you out (since any words you don't like are not aimed at you at all) and which are fully inclusive to everyone involved in the industry, both old and new, not just you.
 
 -- 
Mark Rousell

---

From: Jari Arkko <[email-masked]>
Date: Fri, 21 Sep 2018 09:11:43 +0300

Evan, Carsten, John, Yoav,

> Perhaps "on-path attack".

I agree.

I have actually preferred the use of the "on-path attacker” for a long time, for reasons not associated with this thread. While I have certainly used the term man-in-the-middle (and it is a widely understood term), for some reason I have found it imprecise. With “on-path” I can be accurate about the location of the attacker. It is also IMHO more nicely enhanced with additional qualifiers and variations:

on-path attacker
on-path active attacker
on-path passive attacker (or eavesdropper)
off-path attacker

The principle that should apply is the description of something in clearly understandable language, using the characteristics of that something. And adding gender to those characteristics is just technically wrong, as John points out below.

(There may be some other common attacks that deserve a good term. Or maybe I just don’t know what the term is. E.g., what is the name of an attack where there’s a central server between users, and it is the server that misbehaves?)

> As an
> gender. 

+1

> I don’t think we are promoting inclusiveness by resorting to obscure mythology

+1

Jari

---

From: Eliot Lear <[email-masked]>
Date: Fri, 21 Sep 2018 11:11:34 +0200

Hi John,

I strongly agree, and would go further.

As I see it, the HRPC suffers fundamental problems from both
participation and its charter. 

The charter itself, in my opinion, displays a facile understanding of
human rights.  It includes the statement:

> * To expose the relation between protocols and human rights, with a
> focus on
> the rights to freedom of expression and freedom of assembly.

That belies the need to balance rights contained in frameworks such as
the UDHR, as you and others including myself have repeatedly noted.  We
have largely been ignored.  The poor interdisciplinary composition of
the group as well as its sole output reflects this regrettable constraint.

In this latest debacle, a position was put forth that is largely
unsubstantiated.  The only research I as a layperson have found finds
that harm related to offensive language is contextually determined.[1] 
Surely it's the case that a choice of words *can* harm, and maybe even
harm human rights. However, the HRPC appears to not have the expertise
either in psychology or linguistics to even have a serious discussion
about language, and the co-chair has attempted to stifle debate.  The
research group is not having a discussion that reflects the results or
ongoing work of any research.

As you say, there really are serious human rights issues relating to our
technology that we as a community could and should address. 
Unfortunately, so far as I can tell, there are no criminologists,
members from the law enforcement community, or human rights experts from
interested governments.  While it's always difficult to engage
interdisciplinary experts in the HRPC, the sole focus on a subset of
human rights clearly presents an additional obstacle. Research *is*
happening, but it is happening elsewhere and with zero
collaboration/coordination from HRPC.[2]

If this entire debate over master/slave is about inclusiveness, nothing
could harm that objective more than advocacy of particular political
positions.  Sadly, that is precisely what focusing on a small subset of
rights has led to.  The HRPC should either be rechartered or closed. 
Because I am skeptical we can really attract the right participants, _I
lean toward closure_.

Eliot

[1] Jay, T. (2009). Do offensive words harm people? Psychology, Public
Policy, and Law, 15(2), 81-101.
http://dx.doi.org/10.1037/a0015646
[2] Savage, C., "Justice Dept. Revives Push to Mandate a Way to Unlock
Phones", The New York Times, 24 Mar 2018, 
https://www.nytimes.com/2018/03/24/us/politics/unlock-phones-encryption.html

---

From: Niels ten Oever <[email-masked]>
Date: Fri, 21 Sep 2018 12:09:22 +0200

I am a bit surprised about this conversation here and now, especially
with the recent uptick in human rights reviews of several protocols
(which have all been well received by draft authors), new drafts being
developed and discussed and more researchers coming into this
interdisciplinary RG. This work is also the explicit focus of at least 3
researchers I know of.  Also, there is no other RG I know of which has
had contributions from a UN special rapporteur, and an explicit mention
in his report to the UN.

But if you think this is not sufficiently interdisciplinary, I think the
RG would welcome the discussion of other topics and influx of new people
very much (as it has always done), and there is still ample time to
submit new drafts and agenda points before IETF103.

This sub-thread sounds a bit like: I don't like what is being discussed,
so let's close it down.

Best,

Niels

---

From: Lloyd Wood <[email-masked]>
Date: Fri, 21 Sep 2018 11:01:45 +0000 (UTC)

Niels,

you are surprised about this conversation here and now on HPRC,
despite you being the very person who initiated this conversation
introducing the topic of HPRC to the main list? And you complain
about someone expressing a contrary and dissenting position while
emailing from **digitaldissidents**.org? Irony much?

(I'd also like to know why my replies to you aren't cc'ing the
list by default; that does look like an attempt to stifle debate,
but I don't see the expected Reply-To: in headers.)

L.

remember: social justice warriors have never been to war.
Lloyd Wood [email-masked] http://about.me/lloydwood 

________________________________
From: Niels ten Oever <[email-masked]>
To: [email-masked] 
Sent: Friday, 21 September 2018, 20:10
Subject: Re: why exactly is HRPC for, was Diversity and offensive terminology in RFCs

Best,

Niels

---

From: Eliot Lear <[email-masked]>
Date: Fri, 21 Sep 2018 15:02:40 +0200

On 21.09.18 02:35, Ted Lemon wrote:
> This discussion was triggered by actual complaints by actual people,
> and the terms about which the complaints were made are used in IETF
> standards; this is why it's a matter of interest.

Although we don't actually have any specifics as to why or how the
terminology posed a problem.  We have no understanding of the harm in
this case.  In python one person chose to believe that another person
really had a problem, and that was that, end of discussion.

Eliot

---

From: Kathleen Moriarty <[email-masked]>
Date: Fri, 21 Sep 2018 09:16:45 -0400

On Fri, Sep 21, 2018 at 2:12 AM Jari Arkko <[email-masked]> wrote:

> I have actually preferred the use of the "on-path attacker” for a long
> time, for reasons not associated with this thread. While I have certainly
> used the term man-in-the-middle (and it is a widely understood term), for
> some reason I have found it imprecise. With “on-path” I can be accurate
> about the location of the attacker. It is also IMHO more nicely enhanced
> with additional qualifiers and variations:
>
> on-path attacker
> on-path active attacker

This sounds like a good suggestion to me, a direct and to the point
description.

Thanks,
Kathleen

>
> The principle that should apply is the description of something in clearly
> understandable language, using the characteristics of that something. And
> adding gender to those characteristics is just technically wrong, as John
> points out below.
>
> (There may be some other common attacks that deserve a good term. Or maybe
> I just don’t know what the term is. E.g., what is the name of an attack
> where there’s a central server between users, and it is the server that
> misbehaves?)
>
> > As an

-- 

Best regards,
Kathleen

---

From: Alissa Cooper <[email-masked]>
Date: Fri, 21 Sep 2018 09:21:49 -0400

I wanted to send a friendly reminder to keep discussions on this list professional, respectful, and courteous, per RFC 3005 and RFC 7154. The sergeants-at-arms are following up with individuals off-list as necessary.

Niels, I think there might be two further contributions from you that could be helpful in this discussion. If you have links to relevant research in this area, those might be useful to share. I’m not saying that in the sense that you bear a burden of proof, but really just encouraging you and others to share research results that may be directly relevant if you’re aware of them.

The other helpful item would be a clarification about what is being proposed. Are you interested in updating previously published RFCs, having authors use different terminology going forward, both, something else? Or were you just looking to spark discussion?

Thanks,
Alissa

---

From: Paul Wouters <[email-masked]>
Date: Fri, 21 Sep 2018 09:36:32 -0400

> On Sep 21, 2018, at 07:01, Lloyd Wood <lloyd.wood=[email-masked]> wrote:
> 
> Niels,
> 
> introducing the topic of HPRC to the main list?

Niels introduced a topic from HPRC that he thought warranted discussion outside of HPRC. Since HPRC per definition is about ALL of IETF considering the impact of IETF protocols on human rights, that is appropriate and expected output of the group.

What Niels was surprised about was some people’s reaction to close down HPRC, and I concur with Niels’ surprise. The arguments so far (from you and John Levine) have been that since HRPC didn’t attain world peace and universal human rights, it should be closed down. It fails to understand the groups goal. If that kind of measuring is used, the Security Area and IPv6 groups should have been closed down years ago.

> And you complain

Niels is not complaining, you are. And this attack doesn’t belong on this list.

> but I don't see the expected Reply-To: in headers.)

And now you seem to imply the [email-masked] list settings are somehow Niels’ fault. If you want to complain about these, a new thread devoid of HRPC discussion, just discussions this particular’s list settings would be the appropriate way to raise this as an issue to discuss.

> remember: social justice warriors have never been to war.

You are trying to prove that you “mastered”  flame baiting?

I guess if anything, you showed that IETF has a lot of work to do to become more inclusive and considerate, and if we really need to discuss whether HRPC should be closed down or not (I don’t think we do) than your behavior shows the need to keep it open.

Paul

---

From: Ted Lemon <[email-masked]>
Date: Fri, 21 Sep 2018 09:43:29 -0400

Eliot, actually the HRPC RG does attract subject matter experts who speak
at HRPC sessions and provide useful input. I’ve gotten some real benefit
from these presenters. I do wish they would participate in the process.

The master/slave thing was approached as many workplace harassment
incidents are: with confidential complaints. This was a real problem that
was taken appropriately seriously, and I think the various communities that
responded did so appropriately. Your characterization of the situation is
unfortunate.

Of course it’s also understandable, because this led to the question of
whether we should look at other terminology to see if it has the same
problem, with zero data to back up such a quest. I agree that that is a
fool’s errand.

The reason we are having this particular flame war has a lot to do with the
lack of crispness of the question that was asked of the IETF, and not much
to do with the qualifications of the participants in the RG.

On Fri, Sep 21, 2018 at 5:12 AM Eliot Lear <lear=[email-masked]>
wrote:

> As I see it, the HRPC suffers fundamental problems from both participation
> and its charter.
>
> * To expose the relation between protocols and human rights, with a focus
> on
> That belies the need to balance rights contained in frameworks such as the
> UDHR, as you and others including myself have repeatedly noted.  We have
> largely been ignored.  The poor interdisciplinary composition of the group
> as well as its sole output reflects this regrettable constraint.
>
> unsubstantiated.  The only research I as a layperson have found finds that
> harm related to offensive language is contextually determined.[1]  Surely
> it's the case that a choice of words *can* harm, and maybe even harm
> human rights. However, the HRPC appears to not have the expertise either in
> psychology or linguistics to even have a serious discussion about language,
> and the co-chair has attempted to stifle debate.  The research group is not
> having a discussion that reflects the results or ongoing work of any
> research.
>
> technology that we as a community could and should address.  Unfortunately,
> so far as I can tell, there are no criminologists, members from the law
> enforcement community, or human rights experts from interested
> governments.  While it's always difficult to engage interdisciplinary
> experts in the HRPC, the sole focus on a subset of human rights clearly
> presents an additional obstacle. Research *is* happening, but it is
> happening elsewhere and with zero collaboration/coordination from HRPC.[2]
>
> Because I am skeptical we can really attract the right participants, *I
> lean toward closure*.
>
> Eliot
>
> In article <[email-masked]> <[email-masked]> you write:
>

---

From: Donald Eastlake <[email-masked]>
Date: Fri, 21 Sep 2018 09:48:39 -0400

>> on-path passive attacker (or eavesdropper)

I don't quite agree. The essence of X-in-the-middle, say between B and
C, is that B and C end up only conversing with X. That is to say,
there are no messages directly between B and C because the attacker is
blocking them or because the attack causes B and C to be confused and
only exchange messages with X even though B and C could directly
exchange messages if they tried. "on-path" only implies ability to
observe messages. "active" only implies that the attacker initiates
messages or interferes with existing messages.

Thus all X-in-the-middle attackers are "on-path active attackers" but
not all "on-path active attackers" are X-in-the-middle attackers. For
example I do not consider an on-line active attacker that observes
traffic and just inserts new messages to mess things up, for example a
replay attacker, to be an X-in-the middle attacker.

Thanks,
Donald

> This sounds like a good suggestion to me, a direct and to the point description.
>
> Thanks,
> Kathleen
>>
>>

---

From: Lloyd Wood <[email-masked]>
Date: Fri, 21 Sep 2018 14:10:52 +0000 (UTC)

Paul

"The arguments so far (from you and John Levine) have beenthat since HRPC didn’t attain world peace anduniversal human rights, it should be closed down."
I can see where John suggested that.
But where did I suggest or endorse that idea?
I suspect you're confusing skepticism for stifling dissent.And that you're confusing me with Eliot Lear.
(on my mail agent behaviour, I'm suspecting the mail agent.)
L. 
Lloyd Wood [email-masked] http://about.me/lloydwood 

      From: Paul Wouters <[email-masked]>
 To: Lloyd Wood <[email-masked]> 
Cc: "[email-masked]" <[email-masked]>
 Sent: Friday, 21 September 2018, 23:38
 Subject: Re: why exactly is HRPC for, was Diversity and offensive terminology in RFCs

Paul

---

From: Niels ten Oever <[email-masked]>
Date: Fri, 21 Sep 2018 16:16:04 +0200

Hi Alissa, all,

On 09/21/2018 03:21 PM, Alissa Cooper wrote:
> > The other helpful item would be a clarification about what is being
proposed. Are you interested in updating previously published RFCs,
having authors use different terminology going forward, both, something
else? Or were you just looking to spark discussion?

I think there are two parts of this discussion. The first part is having
a conversation in our community about the the implications and the power
of language and metaphors that we use. A seminal paper about this is:

'Danger! Metaphors at Work in Economics, Geophysiology, and the Internet'
by Sally Wyatt - Science, Technology, & Human Values, Volume: 29 issue:
2, page(s): 242-261 Issue published: April 1, 2004

https://www.exeter.ac.uk/media/universityofexeter/internationalexeter/documents/iss/Wyatt_danger-metaphors_%283%29.pdf

A more concrete and maybe relevant article addressing explicitly the
master/slave metaphor is:

'Broken Metaphor: The Master-Slave Analogy in Technical Literature' by
Ron Eglash - Technology and Culture Vol. 48, No. 2 (Apr., 2007), pp.
360-369

https://www.jstor.org/stable/40061475?seq=1#metadata_info_tab_contents

And another relevant article on the affordances of infrastructure and
its impact on diverse participation:

'‘Anyone can edit’, not everyone does: Wikipedia and the gender gap' by
Ford, Heather and Wajcman, Judy (2017) Social Studies of Science. ISSN
0306-3127

http://eprints.lse.ac.uk/68675/

The second (more concrete) part of this conversation would be the
development of a draft which would map potentially problematic language
and list alternatives for authors to use going forward.

People have already been developing interesting solutions already in
this thread, so in that sense this discussion has already been useful.

Several people have approached me off-list with inputs for a draft and
my thinking is that we could maybe have a BoF-session about this in
Bangkok, since there definitely seems to be interest in the topic.

As always, happy to discuss.

Best,

Niels

---

From: Toerless Eckert <[email-masked]>
Date: Fri, 21 Sep 2018 16:42:13 +0200

Less is more. We already refer to such entities as "middlebox".

"middlebox attack", "middlebox intervention". 

Box is the new Man ?

Toerless

On Fri, Sep 21, 2018 at 09:48:39AM -0400, Donald Eastlake wrote:
> >> >> The up-to-date term of art is ???middleperson attack???
> >> >
> >> I have actually preferred the use of the "on-path attacker??? for a long time, for reasons not associated with this thread. While I have certainly used the term man-in-the-middle (and it is a widely understood term), for some reason I have found it imprecise. With ???on-path??? I can be accurate about the location of the attacker. It is also IMHO more nicely enhanced with additional qualifiers and variations:
> >>
> >> on-path attacker
> >> on-path active attacker
> >> (There may be some other common attacks that deserve a good term. Or maybe I just don???t know what the term is. E.g., what is the name of an attack where there???s a central server between users, and it is the server that misbehaves?)
> >>
> >> > As an
> >> > I don???t think we are promoting inclusiveness by resorting to obscure mythology
> >>
> >> +1
> >>
> >> Jari
> >>
> >
> >
> > --
> >
> > Best regards,
> > Kathleen

-- 
---
[email-masked]

---

From: Ted Lemon <[email-masked]>
Date: Fri, 21 Sep 2018 10:42:18 -0400

> really had a problem, and that was that, end of discussion.

Eliot, I've actually explained the context of what transpired to you on the hrpc mailing list, and I don't see what I said reflected in your response here.   It wasn't "one person."   And it wasn't just python—when this was raised in another open source project and taken to a vote, a majority were in favor of using different terms.   None of this rises to the level of statistical clarity, but when dealing with issues like this, that kind of data is difficult to come by.

Do I need to point out to you that quite frequently in situations with bad power dynamics, getting accurate reports from injured parties is very difficult, and there's a strong tendency for their reports to be disbelieved by the majority in power, but when the dam finally breaks, it becomes clear that there was a real problem, and that the majority, in ignoring that problem, created real and substantial harm.

If our standard for approaching this problem involves small p-values, I doubt that we will make any changes at all.   The question is, do we need to require that standard of evidence, or are anonymous reports from people who say they have experienced abuse as a result of the use of this terminology sufficient?

---

From: Anton Ivanov <[email-masked]>
Date: Fri, 21 Sep 2018 15:43:46 +0100

Err... that is social "science" without a single number on it.

At the very least quote an article with a statistically significant 
survey of engineers who have been horribly offended by the use of 
"master/slave" terminology. I would be interested to see one.

A.

---

From: Ted Lemon <[email-masked]>
Date: Fri, 21 Sep 2018 10:44:20 -0400

> replay attacker, to be an X-in-the middle attacker.

I don't actually think we need to change this particular term, but if we decide that it is worth changing, there are some fairly obvious ways to address your concern here.   E.g., "agent-in-the-middle" or "on-path interception."

I tend to agree with Jari that the technical reason for using clearer terminology is strong; man-in-the-middle is often used for types of on-path attack that you are, rightly, excluding here.

---

From: Paul Wouters <[email-masked]>
Date: Fri, 21 Sep 2018 11:20:17 -0400 (EDT)

> Err... that is social "science" without a single number on it.

I hope Niels can add "quoting arbitrary words to imply they are not real" to
the list of questionable things not to write in an RFC or community list.

> At the very least quote an article with a statistically significant survey of 
> engineers who have been horribly offended by the use of "master/slave" 
> terminology. I would be interested to see one.

That is not the bar we are looking for. I think we are looking at replacing
words that have unnecessary bad connotations for a (small or big)
group of people, where doing so would not be to the detriment of the
technical specification (beyond an initial easy learning curve)

I don't think the onus is now on proving what a poor job language has
done to for example women. And you asking for more statistics seems like
putting up an unneccessary barrier to improve in an area where we have
nothing to lose if we improve it.

I am sure NASA is even better at longlived discussions and stalemates
than we are, and even they updated their History Program Office style
guide in 2006 to say "references referring to the space program should be
non-gender specific.". And even now, people (and especially journalists)
still refer to "manned flight". And that still partialy contributes to
women astronauts being asked about makeup[1] in 2015.

Paul
https://www.sapiens.org/column/wanderers/outer-space-and-gendered-language/

---

From: Eliot Lear <[email-masked]>
Date: Fri, 21 Sep 2018 17:43:58 +0200

On 21.09.18 16:42, Ted Lemon wrote:
> On Sep 21, 2018, at 9:02 AM, Eliot Lear <[email-masked]
> <mailto:[email-masked]>> wrote:
> Eliot, I've actually explained the context of what transpired to you
> on the hrpc mailing list, and I don't see what I said reflected in
> your response here.   It wasn't "one person."  

I didn't mean to imply that it was just python, but I wrote in the
context of python.  I see that I could have been clearer about that. For
that I crave your pardon.  There was one clear example outside of the
context of python where employees used the terminology to bother another
employee (I don't know if it rose to the level of harassment, but it
surely was at least inappropriate behavior).  But see below.

> Do I need to point out to you that quite frequently in situations with
> bad power dynamics, getting accurate reports from injured parties is
> very difficult, and there's a strong tendency for their reports to be
> disbelieved by the majority in power, but when the dam finally breaks,
> it becomes clear that there was a real problem, and that the majority,
> in ignoring that problem, created real and substantial harm.

No I read the newspapers, but I'm not going to recapitulate the entire
hrpc discussion. 

I will say this: I don't suggest for a moment that the matter shouldn't
be studied.  It absolutely should be studied by psychologists,
sociologists, linguists and others.  Let them tell us what the right
thing to do is here, and if the words really are causing harm, sure
let's make changes.  I'd even be happy if they engaged us in whatever
experiment they thought appropriate, assuming it isn't too disruptive. 
But until that happens, I stand in opposition to such changes because
there are negative consequences, and there may not be any upside.

Eliot

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Fri, 21 Sep 2018 11:44:49 -0400

> intermediaries are often there for good helpful reasons.

No, an intermediary is not the same as a Man-in-the-Middle. If you use the
term MITM to me, I will immediately interpret that as a description of an
attack because that is what the established use as a term of art defines it
to be.

You should not be using MITM for any situation where a positive or even a
neutral disposition is intended. It is unclear at best, I regard it as
wrong.

A DNS resolver is a point at which a MITM attack might be staged but it is
not a MITM attack of itself. And the notion that resolvers are mere relays
is actually one that I think is wrong and has held back development of DNS.
The client-resolver protocol need not be the same as the
resolver-authoritative. These are entirely different applications that
should not have been confused in the first place and we are only recently
managing to unconfuse. The no-DNS and DoH work are examples showing why the
resolver-authoritative protocol is not the most effective.

If I talk about an Email relay being a MITM then I am saying that changing
my character set, wrapping lines and all the really obnoxious behavior they
routinely engage in are attacks.

Of course on the gender neutral side, MITM attacks are traditionally
performed by Eve. And historically, many of the intercept operators on the
allied side were women. It was one of the few field combat roles they were
permitted.

---

From: Toerless Eckert <[email-masked]>
Date: Fri, 21 Sep 2018 18:00:11 +0200

> neutral disposition is intended. It is unclear at best, I regard it as

Isn't that a matter of perspective ?
Whose declaration of disposition do you use ?  The one of the MITM ?
I can only call myself MITM if i think my intentions are evil ?

How about all those middleboxes NAT/FW whose operators want to
do something good for Alice&Bob ?

Toerless

---

From: Nico Williams <[email-masked]>
Date: Fri, 21 Sep 2018 11:10:42 -0500

> them. The fact that "master/slave" was well understood within engineering

I use master/replica or primary/replica (in case anyone takes offense at
"master" even in a context in which "slave" does not appear).

> with small effort to provide synonyms which are more easily understood -

Do these terms have racial etymologies, or is a racial tinge being
inferred where there has been none?

Consider that English is my third language.  Why would I know the answer
to this question?  A brief search seems to indicate that their origins
are not racial, but perhaps I'm wrong.  E.g.,

Note that using other colors could still give rise to objections.

> confusion is low if we do.

Blacklisting is a bad idea in most cases anyways.  A whitelist in a
world without a blacklist shouldn't have racial tinge imputed, right?

> offensive, but equally I have no idea what term of art would suffice

In crypto literature it is often Mallory who gets in the middle, so she
gets misgendered when called an MITM.  But WITM wouldn't do either,
would it?

Nico
--

---

From: Spencer Dawkins at IETF <[email-masked]>
Date: Fri, 21 Sep 2018 11:42:31 -0500

Just following up on Alissa's note ...

On Fri, Sep 21, 2018 at 8:21 AM Alissa Cooper <[email-masked]> wrote:

> I wanted to send a friendly reminder to keep discussions on this list
> professional, respectful, and courteous, per RFC 3005 and RFC 7154. The
> sergeants-at-arms are following up with individuals off-list as necessary.
>
> Niels, I think there might be two further contributions from you that
> could be helpful in this discussion. If you have links to relevant research
> in this area, those might be useful to share. I’m not saying that in the
> sense that you bear a burden of proof, but really just encouraging you and
> others to share research results that may be directly relevant if you’re
> aware of them.
>
> proposed. Are you interested in updating previously published RFCs, having
> authors use different terminology going forward, both, something else? Or
> were you just looking to spark discussion?
>

I suspect this helpful item is key to making progress with Alissa's first
helpful item.

What I was hoping for, when the thread started, is someone publishing a
list of "term X" that might be better rephrased as "term Y", with enough
discussion to help draft authors know whether replacing X with Y in a draft
was the right thing to do.

The discussion on the nuances of "MITM" in these threads has been a good
example of the kind of thing I'd want to know, if I wanted to make my draft
clearer, and I think "will this make our drafts clearer if we use this
terminology?" might be one good criteria for including "term X"s in the
list.

Other criteria could also be applied - I think Alissa's ask for pointers to
research is a step toward other criteria.

I've actually received an HRPC review for a draft I was working on (
https://datatracker.ietf.org/doc/draft-iab-marnew-report/, in the IAB
stream), and found it useful,and made some changes based on the review, but
I wasn't thinking that anyone on the IAB was going to say "you have to make
all those changes to publish your draft in the IAB stream".

My third term on the IESG ends in March, but I'd be surprised if the
current IESG or any future IESG made a demand like that for drafts in the
IETF stream. We don't even do that with IETF review team reviews now - ADs
look at comments, not who made the comments, and work to ensure that the
right thing happens.

Do the right thing, of course.

Spencer

---

From: Dave Cridland <[email-masked]>
Date: Fri, 21 Sep 2018 17:45:39 +0100

> "master" even in a context in which "slave" does not appear).
"master" and "replica" seem fine to me.

> Note that using other colors could still give rise to objections.
Yeah, the etymology is not racist. Most cultures - possibly all cultures -
associate white with light and goodness, and black with darkness and evil.

Other connotations are different, mind - black is associated with death,
authority, and so on in Europe, whereas white gets death in Asia (and, I
think, Australia).

> world without a blacklist shouldn't have racial tinge imputed, right?
While there's no etymological basis for whitelist and blacklist being
racist, I can understand why it's not a connotation we want to use if
possible.

Dave.

---

From: Mallory Knodel <[email-masked]>
Date: Fri, 21 Sep 2018 20:46:54 +0300

Hi,

New co-chair of HRPC here.

First, I'd like to thank folks who are defending the existence of our
research group. And I'd like to deeply appreciate those throughout this
long thread here, and in HRPC, who are reading and responding, even
though talking about personal and social issues of oppression can be
emotionally taxing. I know that I am emotionally exhausted by it.

I couldn't agree more with everything that Avri said.

For my contribution in this thread, I want to address Eliot Lear,

> the co-chair has attempted to stifle debate

I will admit that based on my experience and expertise that I disagree
with nearly everything that he has said in this discussion. But it has
not been my intention to "stifle debate".

In one response I wrote,

> I'm going to stop you right there.

Of course I didn't actually stop him as he had pre-synchronously written
his message. I also didn't stop him from writing subsequent messages nor
did I want to. Apologies, Eliot. It was nothing more than a debate
gimmick and turn of phrase, but language matters! I won't use it again.

I've drafted a document to collect the various arguments and elements.
Some of which Neils has just shared back to the thread at Alissa's
suggestion. I hope to share that soon.

This debate, at least in part, might be new to the IETF but it is not
new to communities of technologists. I've been part of some of these
communities and I'm glad the debate is happening here, as difficult as
it might be.

With thanks,
-Mallory

On 21/09/2018 17:10, Lloyd Wood wrote:
> Paul
> 
> "The arguments so far (from you and John Levine) have been
> that since HRPC didn’t attain world peace and
> universal human rights, it should be closed down."
> 
> I suspect you're confusing skepticism for stifling dissent.
> And that you're confusing me with Eliot Lear.
> 
> ------------------------------------------------------------------------
> *From:* Paul Wouters <[email-masked]>
> *To:* Lloyd Wood <[email-masked]>
> *Cc:* "[email-masked]" <[email-masked]>
> *Sent:* Friday, 21 September 2018, 23:38
> *Subject:* Re: why exactly is HRPC for, was Diversity and offensive
> terminology in RFCs
> 
> 
> 
>> On Sep 21, 2018, at 07:01, Lloyd Wood
> <lloyd.wood=[email-masked]
> <mailto:[email-masked]>> wrote:
>>
>> Niels,
>>
> Niels introduced a topic from HPRC that he thought warranted discussion
> outside of HPRC. Since HPRC per definition is about ALL of IETF
> considering the impact of IETF protocols on human rights, that is
> appropriate and expected output of the group.
> 
> What Niels was surprised about was some people’s reaction to close down
> HPRC, and I concur with Niels’ surprise. The arguments so far (from you
> and John Levine) have been that since HRPC didn’t attain world peace and
> universal human rights, it should be closed down. It fails to understand
> the groups goal. If that kind of measuring is used, the Security Area
> and IPv6 groups should have been closed down years ago.
> 
>> And you complain
>> emailing from **digitaldissidents**..org? Irony much?
> 
> And now you seem to imply the [email-masked] <mailto:[email-masked]> list
> settings are somehow Niels’ fault. If you want to complain about these,
> a new thread devoid of HRPC discussion, just discussions this
> particular’s list settings would be the appropriate way to raise this as
> an issue to discuss..
> 
> 
> I guess if anything, you showed that IETF has a lot of work to do to
> become more inclusive and considerate, and if we really need to discuss
> whether HRPC should be closed down or not (I don’t think we do) than
> your behavior shows the need to keep it open.
> 
> Paul
> 
> 

-- 
Mallory Knodel
Head of Digital :: article19.org
gpg fingerprint :: E3EB 63E0 65A3 B240 BCD9  B071 0C32 A271 BD3C C780

---

From: Nico Williams <[email-masked]>
Date: Fri, 21 Sep 2018 14:18:29 -0500

On Thu, Sep 20, 2018 at 12:09:06PM +0000, Anne-Marie Eklund-Löwinder wrote:
> Some time ago we had a standardisation committee in Sweden, running a
> project defining the terminology in Swedish for the information
> security area. They came up with Janus-attack rather than man in the
> middle-attack (the latter sounds weird in Swedish).

But it's always *Mallory* who gets in the middle, so I'd call it a
Mallory-in-the-middle attack, which has the very nice property of
abbreviating to MITM, thus minimizing the change to that term of art.

Nico
--

---

From: Nico Williams <[email-masked]>
Date: Fri, 21 Sep 2018 14:19:44 -0500

> Perhaps "on-path attack".

On-path is not good enough.  An active attacker might not be on-path so
much as redirect the path so that they are on it.

Mallory-in-the-middle attack is much better.

Nico
--

---

From: Brian E Carpenter <[email-masked]>
Date: Sat, 22 Sep 2018 08:25:13 +1200

I am a man. I do not object to the phrase "man-in-the-middle".

Could we stop this discussion now please? We can all easily agree
to avoid offensive language, and we have plentiful document review
processes to assist in this.

Regards
   Brian Carpenter

---

From: Nico Williams <[email-masked]>
Date: Fri, 21 Sep 2018 16:13:53 -0500

> abbreviating to MITM, thus minimizing the change to that term of art.

As it happens, one of the HRPC co-chairs is named Mallory (Knodel).
Just to clarify I was not referring to Mallory Knodel but to the
fictional character Mallory of Alice-and-Bob fame, you know, the
characters we use in expositions of cryptographic protocols and their
analyses, the full cast of which you can see in the following page:

        https://en.wikipedia.org/wiki/Alice_and_Bob

Any resemblance to real persons must have been an accident, and anyways,
not mine.  I hope we don't have to rename these fictional characters.

Nico
--

---

From: [email-masked]
Date: Fri, 21 Sep 2018 23:55:10 +0000 (UTC)

Mallory,

judging by the subject line, you may not have intended to send this to the list in its current form, and I'm a bit puzzled as to who you're asking permission of. Do you want that particular mail to be disregarded?

(as previously noted, when you hear 'folks', prepare to be patronised by an American. it's a trigger word... language matters!)

On Saturday, September 22, 2018, 3:46 am, Mallory Knodel <[email-masked]> wrote:

Hi,

In one response I wrote,

With thanks,
-Mallory

---

From: Mallory Knodel <[email-masked]>
Date: Sat, 22 Sep 2018 10:20:57 +0300

> not mine.  I hope we don't have to rename these fictional characters.

I agree with Mallory-in-the-middle if only because I have fun working in
tech with this name. But it doesn't solve the gender problem so much.

Others have mentioned machine-in-the-middle, which has always made the
most sense.

-Mallory

---

From: Mallory Knodel <[email-masked]>
Date: Sat, 22 Sep 2018 10:43:13 +0300

Hi,

Disregard the subject, please. But the rest of the message was meant to
land in your inboxes and the ietf@ archives.

-Mallory

On 22/09/2018 02:55, [email-masked] wrote:
> Mallory,
> 
> 
> judging by the subject line, you may not have intended to send this to
> the list in its current form, and I'm a bit puzzled as to who you're
> asking permission of. Do you want that particular mail to be disregarded?
> 
> 
> (as previously noted, when you hear 'folks', prepare to be patronised by
> an American. it's a trigger word... language matters!)
> 
> 
> Lloyd Wood
> [email-masked]
> 
>     > Lloyd Wood [email-masked] <mailto:[email-masked]>
>     http://about.me/lloydwood 
>     >
>     >
>     >
>     > *From:* Paul Wouters <[email-masked] <mailto:[email-masked]>>
>     > *To:* Lloyd Wood <[email-masked]
>     <mailto:[email-masked]>>
>     > *Cc:* "[email-masked] <mailto:[email-masked]>" <[email-masked]
>     <mailto:[email-masked]>>
>     <mailto:[email-masked]>
>     > <mailto:[email-masked]
>     <mailto:[email-masked]>>> wrote:
>     >>
>     >> Niels,
>     >>
>     > And now you seem to imply the [email-masked] <mailto:[email-masked]>
>     <mailto:[email-masked] <mailto:[email-masked]>> list
>

---

From: S Moonesamy <[email-masked]>
Date: Mon, 24 Sep 2018 03:58:17 -0700

Hi John,
>time for the IRTF to consider whether to shut it down.

[snip]

>don't.  They need to make up their mind whether they're serious.

The charter of the research group states that one of the major aims 
of its research is to expose the relation between protocols and human 
rights with a focus on Article 19 and Article 20 of the UDHR.  There 
are opportunities for continued development in the research group's 
understanding of (IETF) protocols.  Some of the research seems to be 
optimized towards picking what is readily available instead of a 
systematic exploration of the issues.

Regards,
S. Moonesamy