Subject: [ietf-dkim] When will we know the Threat Analysis document is complete

From: Dave Crocker <[email-masked]>
Date: Mon, 30 Jan 2006 13:07:32 -0800

Folks,

Jim has put in quite a bit of effort on the Threat Analysis document.  Multiple 
iterations of a document, with revisions that are highly responsive to community 
feedback, usually makes for a document that is finished.

In the current case, I find myself entirely unclear how we will know when it is 
*really* finished.  Clearly it is not enough to simply run out of comments and 
suggestions from participants. The current mailing list discussion and 
issue-list management will satisfy the needs of the mailing list participants.

However the document must satisfy the requirements of Security Area experts. 
How will we know when we have accomplished that?  I am not aware of an explicit, 
stable reference against which we can target this document.

With luck, my confusion is merely due to my having missed important management 
and documentation actions.  I sure hope so.

However the charter requires completing the threats document within about 30 
days and I see no way to claim that we are likely to meet that milestone.

d/

ps.  Please note that I am sending this to the WG, rather than -- for example -- 
our Area Director.  At the moment, my concern is what WE know to be our task, 
rather than what he or his IESG colleagues might describe it to be.
-- 

Dave Crocker
Brandenburg InternetWorking
<http://bbiw.net>
_______________________________________________
ietf-dkim mailing list
http://dkim.org

---

From: Stephen Farrell <[email-masked]>
Date: Mon, 30 Jan 2006 22:02:49 +0000

Dave,

Dave Crocker wrote:
> Folks,
> 
> Jim has put in quite a bit of effort on the Threat Analysis document.  
> Multiple iterations of a document, with revisions that are highly 
> responsive to community feedback, usually makes for a document that is 
> finished.
> 
> In the current case, I find myself entirely unclear how we will know 
> when it is *really* finished.  Clearly it is not enough to simply run 
> out of comments and suggestions from participants. The current mailing 
> list discussion and issue-list management will satisfy the needs of the 
> mailing list participants.
> 
> However the document must satisfy the requirements of Security Area 
> experts. How will we know when we have accomplished that?  I am not 
> aware of an explicit, stable reference against which we can target this 
> document.
> 
> With luck, my confusion is merely due to my having missed important 
> management and documentation actions.  I sure hope so.
> 
> However the charter requires completing the threats document within 
> about 30 days and I see no way to claim that we are likely to meet that 
> milestone.
> 
> d/
> 
> ps.  Please note that I am sending this to the WG, rather than -- for 
> example -- our Area Director.  At the moment, my concern is what WE know 
> to be our task, rather than what he or his IESG colleagues might 
> describe it to be.

This is always tricky and the short answer is that we won't know since
there may always be a vulnerability that we didn't think about.

In a commercial environment, you basically decide how much to spend
and then spend that much (though some people might say otherwise:-)

However, the IESG did accept our milestones and if we can demonstrate
that we made a good faith and technically competent effort to do the
job, then I think we have as good a defense as you can get in this
case. That's a reason why getting comments on the threats draft is
important. Silence on this produces no evidence (nor btw would simple
acclaim).

The IESG may in fact find additional work is needed, say if they note
a threat we didn't spot, but that'd be to the good in the end (other
than the hopefully slight delay it might introduce).

So, for me, being able to show (via the I-D, issues list and mail
archive) that we've done a good job should be enough. We'll see though.

Stephen.

PS: And in any case, IESG members are smart enough to be able to raise
issues regardless, if that's what they want to do.

---

From: Dave Crocker <[email-masked]>
Date: Mon, 30 Jan 2006 14:18:49 -0800

Stephen

> there may always be a vulnerability that we didn't think about.

Frankly, given the long history of Bad Actor creativity, I assume that the there 
is no issue of "may" but the certitude of "will".

Nonetheless, the threats document must satisfy a "sufficient" set of concerns.

The question is what those are and how will we know when we have satisfied them.

(Just to hammer home my point, I'll give offer an alternate, short, and somewhat 
flip response that is nonetheless meant seriously:  I was not asking about the 
technical competence of the document; I was asking about the process 
requirements for completing a milestone...)

> important. Silence on this produces no evidence (nor btw would simple

The question is whether we are getting comments from the necessary folk?

The Security Area has a long history of being quite good at finding (legitimate) 
flaws.  So the rest of us might well engage in super-human diligence and still 
not satisfy the folks with an effective veto.

How can we be proactive, in this regard?

> archive) that we've done a good job should be enough. We'll see though.

Well, we already have some history with this document.

It began as a personal requirement to convince an AD to sponsor the working 
group.  That requirement was satisfied.

Since then, my sense is that the Security Area feedback we have gotten has been 
far, far less sanguine with our work.

Good project management requires responding to such a situation with more than 
hope. It requires a proactive effort to ensure meeting the deadline.

> issues regardless, if that's what they want to do.

Stephen, the problem is that they raise them after our work is done.

Hence we enter the oft-cited cycle of potentially endless guessing and revision, 
notably protracting things far beyond the scheduled milestone.

I am seeking to understand how we can avoid this very common scenario, 
particularly for a deliverable is of a type that frankly *invites* the problem.

d/
-- 

Dave Crocker

---

From: Stephen Farrell <[email-masked]>
Date: Mon, 30 Jan 2006 22:25:23 +0000

Dave Crocker wrote:
> The Security Area has a long history of being quite good at finding 
> (legitimate) flaws.  So the rest of us might well engage in super-human 
> diligence and still not satisfy the folks with an effective veto.
> 

Fair question. Barry and I already did seek some review and intend
asking again when we're at the start of last call. I'd encourage
others on this list to do the same if you can get additional
review of the draft.

Not sure what more we can do. But suggestions are welcome.

Stephen.

---

From: Dave Crocker <[email-masked]>
Date: Mon, 30 Jan 2006 14:31:26 -0800

> others on this list to do the same if you can get additional

Sounds good.

> Not sure what more we can do. But suggestions are welcome.

Mumble.  Perhaps there is a senior security geek, with appropriate credibility, 
who is not already involved but is relatively supportive of the effort and would 
be willing to do an independent review, as soon as Jim believes the document is 
pretty stable?

-- 

Dave Crocker

---

From: "Hector Santos" <[email-masked]>
Date: Mon, 30 Jan 2006 17:49:26 -0500

----- Original Message -----
From: "Dave Crocker" <[email-masked]>
To: "Stephen Farrell" <[email-masked]>

>> important. Silence on this produces no evidence (nor btw would
>> simple acclaim).
>

You know, I take offense to that statement.  Who are the necessary folks
Dave?    If your form of thinking that necessary input come from
selected people, then why don't cry out to them and ask for their input.
Statements like this doesn't impress me at all and its a good reason why
I have such adversarial attitude about you and others like you. Its a
slap in the face and presents a disservice to everyone that has taken
the personal time and interest to support and provide comments.

Obviously the NEW ISSUE presented must of touch a nerve of truth or real
concern with you because it is common of you to ignore my input.

My apology to the group. But that statement from Dave is not very
appreciative of all the effort people put into this group.

--
Hector Santos, Santronics Software, Inc.
http://www.santronics.com

---

From: Dave Crocker <[email-masked]>
Date: Mon, 30 Jan 2006 23:36:13 -0800

> the personal time and interest to support and provide comments.

Hector, that you did not understand my posting is unfortunate, especially since 
it cited the diligent efforts of folks on the mailing list.

That you chose to post a public note of this form and tone moves the matter into 
a direct ad hominem attack.

This is now a formal IETF working group and there are rules about such behavior.

Since the list has had some history with such misbehaviors, I request the chairs 
to take appropriate action.

d/
-- 

Dave Crocker

---

From: "Hector Santos" <[email-masked]>
Date: Tue, 31 Jan 2006 06:30:19 -0500

Since you put down everyone with your "comments from only necessary
folk" statement in a vain attempt to block any further comments, in
addition since you have a history in the list past and now once again to
publicly defame me, I should be the one requesting appropriate action by
the chairs should be taken against you for personal attacks.

Furthermore, since this is a formal IETF Area and this DKIM effort has a
direct and indirect correlation to our business product mail operations
future, any attempt by you or the IETF to block or censor my access to
this IETF area will be considered tortious interference and will be
followed up with legal action.

Cool it Dave!

----- Original Message -----
From: "Dave Crocker" <[email-masked]>
To: "Hector Santos" <[email-masked]>
Cc: "Stephen Farrell" <[email-masked]>; "DKIM IETF WG"
<[email-masked]>
Sent: Tuesday, January 31, 2006 2:36 AM
Subject: Re: [ietf-dkim] When will we know the Threat Analysis document
iscomplete

---

From: Stephen Farrell <[email-masked]>
Date: Tue, 31 Jan 2006 11:48:23 +0000

This thread has outlived its usefulness. Let's get back to
technical work please.

Stephen.