Subject: [Lurk] Way outside the "box" use case

From: Eric Burger <[email-masked]>
Date: Mon, 29 Feb 2016 12:38:05 -0500

For the people on the STIR list: there is a potential WG being discussed in BA, LURK, that is principally looking at the problem of a content provider somehow allowing a CDN to sign on their behalf so that HTTPS and browsers “do the right thing.” If this sounds /similar/ to the STIR problem of delegated enterprise identity attestation, it should. See:
https://trac.tools.ietf.org/bof/trac/
and scroll down to “Security” or search for “LURK”.
PLEASE, if you care about this issue, continue the discussion on the LURK list, not the STIR list. Thanks. See:
https://www.ietf.org/mailman/listinfo/lurk

For the people on the LURK list: I do not necessarily advocate for or assume the STIR problem is in scope. However, if you and they have a compelling case for why it should be in scope, or if it is kind of in scope but appropriate for a later rechartering once we finish the HTTPS (and possibly DTLS) use case, say so, too. If you are curious about what STIR is, see:
https://trac.tools.ietf.org/wg/stir/charters

Thanks,
Eric

---

From: Stephen Farrell <[email-masked]>
Date: Mon, 29 Feb 2016 21:09:58 +0000

(I like that we're playing this game now. If we get
a bunch of these off the table before B-A, that may
allow us better use the f2f time.)

Here's another one to consider and maybe say "no."

DKIM-signing domains sometimes use partner companies to
e.g. send out marketing crap or userful materials. That
can be done in various ways but using lurk for DKIM-signing
without giving the partner a DKIM private key for my domain
could be yet another use.

I suspect that it'd be considered OTT to use such an
interface for DKIM-signing, but who knows?

Cheers,
S.