Subject: [HASMAT] moving forward

From: Peter Saint-Andre <[email-masked]>
Date: Fri, 20 Aug 2010 12:08:10 -0600

Following up on the successful BoF we held in Maastricht, I'd like to
keep us moving toward formation of a working group. Here are some open
tasks:

1. Chairs. Tobias Gondrom (currently co-chair of the LTANS WG in the
Security Area) has stepped forward to volunteer and I think he'll make a
good co-chair. Thanks, Tobias! However, we need someone to work with
Tobias, preferably someone with (a) more experience in the Applications
Area and (b) strong knowledge of HTTP. Please contact me if you're
interested or you would like to suggest someone else.

2. Charter. We had some feedback at the BoF about charter revisions,
especially focusing on the three drafts under immediate consideration
and removing the text about developing a long-term framework for web
security. Jeff or Hannes, could you send updated charter text to the
list for discussion?

3. Name. Some people have said that "HASMAT" isn't very descriptive of
the subject matter, and that we might want something like "WEBSEC". As
long as folks don't think "WEBSEC" means that we'd be working on
everything under the sun related to the security of the web, I'd be fine
with a name like that. Other suggestions are welcome.

Thanks!

Peter

-- 
Peter Saint-Andre
https://stpeter.im/

---

From: Kai Engert <[email-masked]>
Date: Mon, 23 Aug 2010 12:50:15 +0200

> with a name like that. Other suggestions are welcome.

"websec" sounds indeed very general, while the meaning of "hasmat" 
focuses on a smaller subset.

I wanted to propose "WebAppSec", but there's already 
http://www.webappsec.org/

What about HTSEC ? (hypertext security)

Kai

---

From: Tobias Gondrom <[email-masked]>
Date: Mon, 23 Aug 2010 15:59:17 +0100

Hi all,

just a quick introduction for the ones who might not already know me:
Currently living in London, UK (timezone UTC/GMT+1). My background is in
Web application security, where until recently I spent the last couple
of years heading the security department of an ISV. I've been
co-chairing the LTANS WG in the security area for a couple of years
until this September when we successfully finish its work and close it.
Over the years I became a big fan of "rough consensus and running code".
;-) For me these principles helped a lot to get things done.
Besides enjoying IETF work, I am also member of OWASP (Open Web
Application Security Project) and probably have seen every web app
security problem in the book (and some which aren't).
When I read the drafts and saw the BOF proposal before Maastricht, I
feel very excited about it.
In the past I always worked around some of the problems posed by
underlying infrastructure and this is a great opportunity to remedy some
of the problems at the root!

Whatever I can do to help (even if it's not directly related to the WG),
please feel free to contact me via email, phone, skype,...  and of
course during IETF meetings. I am looking forward to work with you, the
progress of the WG, its charter and the three initial drafts and getting
things done!

Many greetings, Tobias

Ps.: as Peter mentioned we are still looking for a co-chair: Personally,
I feel a WG is faster and more productive with two co-chairs then just
one. So if you think about co-chairing with me, please please drop me a
note.

Tobias Gondrom
Sloan Fellowship 2009
London Business School
email: [email-masked]
mobile: +447521003005

---

From: Tobias Gondrom <[email-masked]>
Date: Mon, 23 Aug 2010 17:17:37 +0100

believe "websec" was proposed during BOF meeting and actually "hasmat"
reminded me of "hazardous materials" at first, so would support to go
for a different name if people like to.
Have no problem if the name is general, after all the charter and not
the name determines WG scope (and as the name will stay even if you may
recharter at some point, so general can rather be an advantage for a name).

htsec is fine for me, too (though personally I may slightly prefer websec).
Would be against webappsec due to ambiguity and actually adding "app" in
the middle doesn't help and makes the name unnecessarily long (there are
practical benefits from short WG names).

Tobias

would agree with websec

On 08/23/2010 11:50 AM, Kai Engert wrote:
> _______________________________________________
> HASMAT mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/hasmat

---

From: Marsh Ray <[email-masked]>
Date: Mon, 23 Aug 2010 11:28:05 -0500

Perhaps it depends on what the group wants to do?

Websec is nice. Not a revolutionary name.

It seems appropriate for this sentence from the proposed charter:
> The goal of this working group is to standardize a small number of
> selected specifications that have proven to improve security of Internet
> Web applications.

Personally, I think the current name is pretty awesome.

- Marsh

---

From: Brandon Sterne <[email-masked]>
Date: Tue, 31 Aug 2010 13:42:49 -0700

> keep us moving toward formation of a working group. Here are some open

Thanks, Peter, for keeping the ball rolling here.

> security.

Not being present at the BoF, I missed the discussion about removing the
creation of a long-term security framework.  If the group focuses on
standardizing a small set of security mechanisms won't it be
contributing to the "sprinkling" problem in the first part of the
Objectives and Scope section?

> with a name like that. Other suggestions are welcome.

Personally, I do think WEBAPPSEC is the right name.  Someone pointed out
that webappsec.org is registered already, but that space is occupied by
the Web Application Security Consortium who generally go by the acronym
WASC.  Other than the domain issue, is this still a problem?

Cheers,
Brandon