Subject: Re: [HASMAT] moving forward

From: =JeffH <[email-masked]>
Date: Tue, 24 Aug 2010 16:39:35 -0700

Thanks Peter for keeping the ball moving.

 > Following up on the successful BoF we held in Maastricht,

yea! thanks all who attended (it was standing-room-only)

 > I'd like to
 > keep us moving toward formation of a working group. Here are some open
 > tasks:
 >
 > 1. Chairs. Tobias Gondrom (currently co-chair of the LTANS WG in the
 > Security Area) has stepped forward to volunteer and I think he'll make a
 > good co-chair. Thanks, Tobias!

Indeed, thanks Tobias.

 > However, we need someone to work with Tobias,

thoughts / volunteers?

I'm presently slated to hack on specs, thus am not a chair candidate.

 > 2. Charter. We had some feedback at the BoF about charter revisions,
 > especially focusing on the three drafts under immediate consideration
 > and removing the text about developing a long-term framework for web
 > security. Jeff or Hannes, could you send updated charter text to the
 > list for discussion?

working on it. tomorrow or Wed.

 > 3. Name. Some people have said that "HASMAT" isn't very descriptive of
 > the subject matter, and that we might want something like "WEBSEC". As
 > long as folks don't think "WEBSEC" means that we'd be working on
 > everything under the sun related to the security of the web, I'd be fine
 > with a name like that. Other suggestions are welcome

It isn't descriptive unless one knows what the acronym represents -- HTTP app 
sec minus authn & transport -- and then it's very descriptive.

It's also sort of an "inside joke" in that HTTP authn is something that gets 
derided often but no one has really wanted to take up and try to do something 
about (AFAIK Peter S-A came up with the HASMAT moniker), and transport 
security, ie TLS/SSL, is addressed elsewhere already, and no one really wants 
to step on their toes. Hence the "HASMAT" double-entendre.

That said we could use "websec" with the understanding (and explicitness in the 
charter) that it's "minus authn & transport".

"websec" will be easier for IETF newbies to find and grok than "hasmat". Tho it 
might get a bit confusing wrt the in-genesis W3C "WebAppSec" WG.

more thoughts?

=JeffH

---

From: Barry Leiba <[email-masked]>
Date: Tue, 24 Aug 2010 21:17:58 -0400

As I've said to Jeff back in Pays-Bas, I'm less concerned about the
name than about the charter.  The problem description at the BoF said
that a main issue is that this stuff has been previously dealt with in
a haphazard manner.  We then looked at three haphazard drafts, which
the charter proposes to standardize.  This doesn't address the core
problem.

What does address the core problem is the part about studying the
problem space.  From one of the proposed charters:

> In addition, this working group will consider the overall topic of HTTP
> application security and compose a "problem statement and requirements"
> document that can be used to guide further work.

I'd like to see much more emphasis placed on this part, and have the
scope of this hashed out a bit more.  I think the focus of the WG
should be on this, with the three existing drafts as something we do
along the way... rather than the other way 'round, as it is now.

Barry