Subject: Re: [Acme] Proposed ACME Charter Language

From: Ted Hardie <[email-masked]>
Date: Wed, 13 May 2015 16:21:25 -0700

FYI, the discussions Martin referenced are those taking place in github,
see:

https://github.com/letsencrypt/acme-spec/issues

​I had not been watching those, but will try to catch up.

Ted​

---

From: "Salz, Rich" <[email-masked]>
Date: Wed, 13 May 2015 23:39:36 +0000

> https://github.com/letsencrypt/acme-spec/issues

I'd prefer if we just recorded issues there, but discussed them in the mailing list.

---

From: Martin Thomson <[email-masked]>
Date: Wed, 13 May 2015 17:07:40 -0700

> I'd prefer if we just recorded issues there, but discussed them in the mailing list.

I'd go further and treat that as a private enterprise.  They might
help track our issues for us, but until we have an "official" tracker,
it has no real standing.

---

From: Russ Housley <[email-masked]>
Date: Thu, 14 May 2015 10:56:22 -0400

> I'd prefer if we just recorded issues there, but discussed them in the mailing list.

+1

Russ

---

From: Peter Eckersley <[email-masked]>
Date: Thu, 14 May 2015 09:57:33 -0700

> I'd prefer if we just recorded issues there, but discussed them in the mailing list.

Folks should also be aware that because letsencypt needs to move fast to
get working and interoperable clients and servers for its launch,
there's a fair chance that it will wind up with a deployed solution that
diverges from the draft spec in various ways, and can't block on an IETF
WG's deliberations.

For that reason I think it's probably best if the WG and spec work
doesn't start in earnest until after Let's Encrypt has launched (IIRC
that was the consensus in Dallas, too).  And in the pre-launch period, a
bug tracker is the most efficient and practical way for us to keep track
of things that we absolutely need to fix/diverge from the draft spec on.

-- 
Peter Eckersley                            [email-masked]
Chief Computer Scientist          Tel  +1 415 436 9333 x131
Electronic Frontier Foundation    Fax  +1 415 436 9993

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Thu, 14 May 2015 12:58:01 -0400

> I'd prefer if we just recorded issues there, but discussed them in the

I would prefer if we avoid getting into practices and policy issues there
as well.

An IETF working group has a finite lifetime and a limited constituency.
Both make it a bad place to decide security policy. We write 'Security
Considerations' not 'Security requirements'.

Validation processes are like algorithms. The IETF can recommend but can't
make a final decision. I think we all agree that it would be a bad thing if
RFC5280 had made SHA-1 support a MUST and that this has in effect been
superseded and this is a good thing.

I don't think we are very likely to be changing crypto algorithms very
frequently in the future. We seem to have a grip on those. But validation
processes seem to me to be something that are not just likely to change, we
would want to keep a watchful eye on.

It isn't even the case that stronger validation mechanisms are necessarily
better or necessarily necessary. We are going to a world where security is
going to be required and insecurity becomes the exception. We are not going
to a world where perfect security is required though. If 'some' security is
required we can get rid of the low assurance security signal (aka padlock
icon) and replace it with a danger signal. for no security.

---

From: Joseph Lorenzo Hall <[email-masked]>
Date: Thu, 14 May 2015 14:16:26 -0400

> of things that we absolutely need to fix/diverge from the draft spec on.

Heya, this reads as if the IETF WG work should block on the
letsencrypt launch and it seemed pretty clear in Dallas that while
letsencrypt is a motivating effort to spin up ACME that neither should
in the short-term be very eeply dependent on each other. (and this is
coming from someone who is very excited about both efforts)

Happy to be corrected if this was a misinterpretation or a mistake on my part.

best, Joe

> _______________________________________________
> Acme mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/acme

-- 
Joseph Lorenzo Hall
Chief Technologist
Center for Democracy & Technology
1634 I ST NW STE 1100
Washington DC 20006-4011
(p) 202-407-8825
(f) 202-637-0968
[email-masked]
PGP: https://josephhall.org/gpg-key
fingerprint: 3CA2 8D7B 9F6D DBD3 4B10  1607 5F86 6987 40A9 A871

---

From: Richard Barnes <[email-masked]>
Date: Thu, 14 May 2015 14:19:27 -0400

> Happy to be corrected if this was a misinterpretation or a mistake on my

Nope, this matches my understanding.  The two efforts can proceed
independently, and we'll try to square them up in good time.

--Ricahrd

---

From: Ted Hardie <[email-masked]>
Date: Thu, 14 May 2015 11:26:23 -0700

Hi Joe,

> coming from someone who is very excited about both efforts)
​Yep, the minutes from Dallas confirm that folks are interested in getting
the WG going, with no mention of blocking while waiting for initial
deployment.​
Kathleen has confirmed that this is her understanding as well, so I think
our
steps are:

Get charter done & approved
Start working group
Fork draft-barnes to draft-ietf
​ Reconverge when draft-ietf progresses.

regards,

Ted​

---

From: Russ Housley <[email-masked]>
Date: Thu, 14 May 2015 17:06:45 -0400

Joe:

That matches my understanding as well.

Russ