Subject: [ietf-privacy] Wiki for managing PPM reviews of existing RFCs

From: Scott Brim <[email-masked]>
Date: Sat, 22 Mar 2014 17:21:36 -0400

(I'm sending to both perpass and ietf-privacy for this announcement,
but follow-up should be only to ietf-privacy)

Greetings. At the London IETF we had a Monday lunch meeting to talk
about doing systematic reviews of existing RFCs. We finally have a
wiki page for tracking that activity. It is at
<https://trac.tools.ietf.org/group/ppm-legacy-review/>.

We are using the Trac ticket system. If you have used tickets for
working group issues, it's essentially the same but with a few
different parameters. There are instructions on how to fill out a
ticket on the web page.

 If you were at the Monday lunch and announced an intention to working
on a particular set of RFCs, now there's a home for your reviews. If
you couldn't commit to doing reviews but want to do some, here is your
chance! (If you don't have a login on the wiki, it's easy to
register.) In both cases, please add a ticket when you _start_ your
review -- don't wait until you finish, people will want to know all
about it from the start.

Thanks,

Scott and Avri

---

From: "Christian Huitema" <[email-masked]>
Date: Sun, 23 Mar 2014 18:25:16 -0700

> review -- don't wait until you finish, people will want to know all

I added a couple of tickets for the various DHCP RFC that I reviewed when
writing the DHCP draft. What is the process for picking new RFC to review?
Just pick one at random and write a provisional ticket in
https://trac.tools.ietf.org/group/ppm-legacy-review/wiki ?

-- Christian Huitema

---

From: Avri Doria <[email-masked]>
Date: Mon, 24 Mar 2014 12:16:12 +0800

> https://trac.tools.ietf.org/group/ppm-legacy-review/wiki ?

essentially, yes.

avri

---

From: "Christian Huitema" <[email-masked]>
Date: Sun, 23 Mar 2014 23:37:00 -0700

>> https://trac.tools.ietf.org/group/ppm-legacy-review/wiki ?

I have written a few more tickets, so the list is not so empty... 

I was going to enter a few comments on RFC 2821, but I wonder whether we
already have some WG dealing with SMTP. There are basically three issue: the
"transport in clear text" issues, the "ease of spoofing" issue, and the "too
much information" issue. I assume that the transport issues are addressed by
the current TLS effort. I don't know whether anyone is working on the "ease
of spoofing" issue, which is known to be abused for "spear phishing" and
other fun exercises. And I also don't know whether anyone is looking at
information minimization, e.g. not carrying the "private" IP address of a
user in the Received list, or not exposing a full list of message recipients
to all relays.

-- Christian Huitema

---

From: "Jiankang Yao" <[email-masked]>
Date: Mon, 24 Mar 2014 10:49:10 +0800

From: Scott Brim
Date: 2014-03-23 05:21
To: ietf-privacy; perpass
Subject: [perpass] Wiki for managing PPM reviews of existing RFCs

>https://trac.tools.ietf.org/group/ppm-legacy-review/.
>
>

it is a good start. thanks.
since there are thousands of RFCs, it is better that they can be reviewd by category.
for example, based on the following category:
http://www.faqs.org/rfcs/np.html 

Jiankang Yao

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Mon, 24 Mar 2014 10:49:18 +0100

On Mon, Mar 24, 2014 at 10:49:10AM +0800,
 Jiankang Yao <[email-masked]> wrote 
 a message of 116 lines which said:

> since there are thousands of RFCs,

IMHO, the work should be indexed by PROTOCOL not by RFC, since some
protocols are specified in many RFCs (DNS...)

---

From: Stephen Farrell <[email-masked]>
Date: Mon, 24 Mar 2014 09:53:54 +0000

(bcc'ing perpass and moving this to ietf-privacy which
we agreed was a better list for this)

On 03/24/2014 03:46 AM, Melinda Shore wrote:
> On 3/23/14 6:49 PM, Jiankang Yao wrote:
> I'm not sure about that - there are a lot of documents
> defining protocols that have never been implemented or
> deployed, and so on.  It seems likely to me that as this
> process is starting up, people will tend to review
> significant documents, which is what probably the best
> place to start anyway.  As more documents are reviewed
> there may be a need to become more systematic.  But
> for now, I think the current situation is good.

I agree with Melinda. Let's get a body of work done
that people want to do or feel is important to do
and then we can organise that.

So jump in and review something.

S.

> 
> Melinda
> 
> 
> _______________________________________________
> perpass mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/perpass
>

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Mon, 24 Mar 2014 10:53:10 +0100

On Sat, Mar 22, 2014 at 05:21:36PM -0400,
 Scott Brim <[email-masked]> wrote 
 a message of 29 lines which said:

> We finally have a wiki page for tracking that activity. It is at

Trac has an issue:

Warning: The ticket has been created, but an error occurred while sending notifications: [Errno 111] Connection refused

---

From: Scott Brim <[email-masked]>
Date: Mon, 24 Mar 2014 08:14:32 -0400

> https://trac.tools.ietf.org/group/ppm-legacy-review/wiki ?

At the Monday lunch, a few people listed areas they were most concerned
about, so we had a general sense of what we can expect to be covered soon
and where the big gaps in coverage of essential RFCs will be. You've
essentially done the same. That's all there is to it, for now. Thanks.

Scott

---

From: Scott Brim <[email-masked]>
Date: Mon, 24 Mar 2014 08:22:45 -0400

> http://www.faqs.org/rfcs/np.html

We want to make sure the essential RFCs are reviewed, and categories are a
good way to organize that if you know what categories to use. We don't have
enough experience yet to know what good categories would be -- we don't
know how many reviewers we will have our their interest areas. To start
with let's just get everyone doing reviews. We can organize them later,
once we get over a hundred.

Thanks... Scott

---

From: Scott Brim <[email-masked]>
Date: Mon, 24 Mar 2014 08:34:02 -0400

> protocols are specified in many RFCs (DNS...)

The unit of specification is the RFC, so shouldn't that be the main key for
indexing? We have a dropdown for IETF area -- we could use another field,
text, for affected protocols.

Your ticket #8 is good for showing "intention". I hadn't thought of using
initial entries like that, and it's an intriguing idea. I think I'm in
favor. However, when you do an actual review, could you either modify your
existing entry or add a new one for each specific RFC?

Scott

---

From: "Horne, Rob" <[email-masked]>
Date: Mon, 24 Mar 2014 12:31:41 +0000

Hi, I'm interested in reviewing RFCs so could someone tell me - or point me in the direction of - what the goals are, how to conduct a review and what exactly are we looking for?

Thanks,

Rob

From: ietf-privacy [mailto:[email-masked]] On Behalf Of Scott Brim
Sent: 24 March 2014 12:23
To: yaojk
Cc: [email-masked]; perpass
Subject: Re: [ietf-privacy] [perpass] Wiki for managing PPM reviews of existing RFCs

> http://www.faqs.org/rfcs/np.html

We want to make sure the essential RFCs are reviewed, and categories are a good way to organize that if you know what categories to use. We don't have enough experience yet to know what good categories would be -- we don't know how many reviewers we will have our their interest areas. To start with let's just get everyone doing reviews. We can organize them later, once we get over a hundred.

Thanks... Scott

---

From: Scott Brim <[email-masked]>
Date: Mon, 24 Mar 2014 08:34:51 -0400

On Mar 24, 2014 5:53 AM, "Stephane Bortzmeyer" <[email-masked]> wrote:
> Warning: The ticket has been created, but an error occurred while sending
notifications: [Errno 111] Connection refused

Ok, I'll tell Henrik. He manually added a notification. Thanks.

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Mon, 24 Mar 2014 13:47:15 +0100

On Mon, Mar 24, 2014 at 08:34:02AM -0400,
 Scott Brim <[email-masked]> wrote 
 a message of 56 lines which said:

> Your ticket #8 is good for showing "intention". 

It's not a pure intention, the Internet-Draft already exists and is,
IMHO, a pretty comprehensive review of DNS privacy considerations.

---

From: Stephen Farrell <[email-masked]>
Date: Mon, 24 Mar 2014 15:03:02 +0000

Hi Rob,

On 03/24/2014 12:31 PM, Horne, Rob wrote:
> Hi, I'm interested in reviewing RFCs so could someone tell me - or
> point me in the direction of - what the goals are, how to conduct a
> review and what exactly are we looking for?

I guess you can infer most of that from threads on this and the
perpass [1] mailing list, the notes from the Monday lunch [2]
and the wiki [3].

But since that's a lot of putting stuff together, here's my quick
summary:

- The IETF are rightly putting some more focus on privacy both
as a result of [4] and [5], but also because its the right thing
to do
- Part of that will involve figuring out how better to handle
reviews of works-in-progress, e.g. via secdir and gen-art reviews,
but that's not this activity (though will be informed by it)
- Another part (initially suggested I think by Christian Huitema
back in Vancouver) is reviewing existing RFCs and that is this
bit
- The goal of these reviews is to analyse those existing RFCs
for privacy issues or issues related to pervasive monitoring
and document those in some useful fashion
- Ideally, that analysis might also suggest mitigations, some
of which might be things one can do now, whilst others might
be things that'd require changes to protocols, implementations
or deployments
- For the latter cases, we're not proposing to do everything
now, but as and when protocols are revised (or if we find
something startling) then we'd hope that revisions would take
account of the analyses done here (and because [4] is now
approved as a new BCP, that is not a forlorn hope:-)
- In some cases, reviews will highlight privacy issues that
might not be intrinsic to the protocol in the RFC, but that
arise due to how that protocol is now deployed (which may be
quite different from how that was initially envisaged to
happen)
- Writing up the analysis as an Internet-draft is a fine
way to do that (so its archived etc.); there are a couple
of examples in the tracker which should be useful help
- Avri and Scott have been helping out with organising this and
have put up the wiki at [1]
- For people who want to review something - go pick a thing for
which you think you're qualified to do a good review and ideally
which you think is important and then... just do it
- Its not a sin to find nothing nor to do an imperfect job, but
the better the job done... the better the job done:-)
- Make a ticket so's we don't waste effort having a few folks
doing stuff and so we can keep track
- I'd say maybe don't put in speculative tickets (e.g. meaning
"someone, but not me, really ought review RFCxxxx"), but just
add tickets for stuff you've done or are doing now or in the
quite near future
- Try get initial work done and visible by mid-May so we can
see how we're doing and consider that before and during the
July IETF

Cheers, (and thanks all for doing stuff!),
S.

[1] http://www.ietf.org/mail-archive/web/perpass/current/maillist.html
[2] http://www.ietf.org/mail-archive/web/perpass/current/msg01640.html
[3] https://trac.tools.ietf.org/group/ppm-legacy-review/wiki
[4] http://tools.ietf.org/html/draft-farrell-perpass-attack
[5] http://tools.ietf.org/html/draft-barnes-pervasive-problem-00

> 
> 
> 
> Thanks,
> 
> Rob
> 
> 
> 
> 
> 
> 
> 
> 
> 
> From: ietf-privacy [mailto:[email-masked]] On Behalf
> Of Scott Brim Sent: 24 March 2014 12:23 To: yaojk Cc:
> [email-masked]; perpass Subject: Re: [ietf-privacy] [perpass]
> Wiki for managing PPM reviews of existing RFCs
> 
> 
> 
> 
> On Mar 23, 2014 10:49 PM, "Jiankang Yao"
> <[email-masked]<mailto:[email-masked]>> wrote:
>> since there are thousands of RFCs, it is better that they can be
>> reviewd by category. for example, based on the following category: 
> We want to make sure the essential RFCs are reviewed, and categories
> are a good way to organize that if you know what categories to use.
> We don't have enough experience yet to know what good categories
> would be -- we don't know how many reviewers we will have our their
> interest areas. To start with let's just get everyone doing reviews.
> We can organize them later, once we get over a hundred.
> 
> Thanks... Scott
> 
> 
> 
> 
> _______________________________________________ ietf-privacy mailing
> list [email-masked] 
> https://www.ietf.org/mailman/listinfo/ietf-privacy
>

---

From: "Horne, Rob" <[email-masked]>
Date: Mon, 24 Mar 2014 15:17:13 +0000

Thanks for the excellent summary Stephen, Looks like I've got some reading to do before I get started :-)

Rob

-----Original Message-----
From: Stephen Farrell [mailto:[email-masked]]
Sent: 24 March 2014 15:03
To: Horne, Rob; [email-masked]
Subject: Re: [ietf-privacy] [perpass] Wiki for managing PPM reviews of existing RFCs

Hi Rob,

> review and what exactly are we looking for?

I guess you can infer most of that from threads on this and the perpass [1] mailing list, the notes from the Monday lunch [2] and the wiki [3].

- The IETF are rightly putting some more focus on privacy both as a result of [4] and [5], but also because its the right thing to do
- Part of that will involve figuring out how better to handle reviews of works-in-progress, e.g. via secdir and gen-art reviews, but that's not this activity (though will be informed by it)
- Another part (initially suggested I think by Christian Huitema back in Vancouver) is reviewing existing RFCs and that is this bit
- The goal of these reviews is to analyse those existing RFCs for privacy issues or issues related to pervasive monitoring and document those in some useful fashion
- Ideally, that analysis might also suggest mitigations, some of which might be things one can do now, whilst others might be things that'd require changes to protocols, implementations or deployments
- For the latter cases, we're not proposing to do everything now, but as and when protocols are revised (or if we find something startling) then we'd hope that revisions would take account of the analyses done here (and because [4] is now approved as a new BCP, that is not a forlorn hope:-)
- In some cases, reviews will highlight privacy issues that might not be intrinsic to the protocol in the RFC, but that arise due to how that protocol is now deployed (which may be quite different from how that was initially envisaged to
happen)
- Writing up the analysis as an Internet-draft is a fine way to do that (so its archived etc.); there are a couple of examples in the tracker which should be useful help
- Avri and Scott have been helping out with organising this and have put up the wiki at [1]
- For people who want to review something - go pick a thing for which you think you're qualified to do a good review and ideally which you think is important and then... just do it
- Its not a sin to find nothing nor to do an imperfect job, but the better the job done... the better the job done:-)
- Make a ticket so's we don't waste effort having a few folks doing stuff and so we can keep track
- I'd say maybe don't put in speculative tickets (e.g. meaning "someone, but not me, really ought review RFCxxxx"), but just add tickets for stuff you've done or are doing now or in the quite near future
- Try get initial work done and visible by mid-May so we can see how we're doing and consider that before and during the July IETF

Cheers, (and thanks all for doing stuff!), S.

>
>
>
> Thanks,
>
> Rob
>
>
>
>
>
>
>
>
>
> From: ietf-privacy [mailto:[email-masked]] On Behalf Of
> Scott Brim Sent: 24 March 2014 12:23 To: yaojk Cc:
> We don't have enough experience yet to know what good categories would
> be -- we don't know how many reviewers we will have our their interest
> areas. To start with let's just get everyone doing reviews.

---

From: Scott Brim <[email-masked]>
Date: Mon, 24 Mar 2014 12:33:37 -0400

I will add some resource pointers to the wiki, e.g. RFC 6973.