Subject: Re: [TLS] TLS DNSSEC chain consensus text, please speak up...

From: Thomas Lund <[email-masked]>
Date: Wed, 16 May 2018 13:32:14 +0200

FWIW: I support the changes proposed by Viktor and others. In particular, I
support reserving 2 bytes for which the semantics will be defined in a
separate draft.
For me, the advantages of this proposal outweighs the disadvantage of
having to reserve 2 bytes that might, in worst case, never get used.

---

From: Ted Lemon <[email-masked]>
Date: Wed, 16 May 2018 11:01:18 -0400

I have no pony in this race, but FWIW ~5 people on each side represents a
lack of consensus.   A lack of consensus means that the work doesn't happen
in the working group.

Thomas, your response (sorry to pick on you!) illustrates another consensus
issue: consensus exists when all technical objections have been addressed.
  Melinda made a pretty serious technical objection.  Your response is not
responsive to her objection.   She explicitly said that her objection was
not the two bytes.   So from the perspective of consensus, it's as if you
hadn't sent an email message—an accurate evaluation of consensus would not
take what you said into account at all.

On Wed, May 16, 2018 at 7:32 AM, Thomas Lund <[email-masked]>
wrote:

> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tls
>

---

From: James Cloos <[email-masked]>
Date: Wed, 16 May 2018 18:20:19 -0400

>>>>> "TL" == Ted Lemon <[email-masked]> writes:

TL> Melinda made a pretty serious technical objection.  Your response is not
TL> responsive to her objection.   She explicitly said that her objection was
TL> not the two bytes.

I don't see anything in her note today which is a technical objection.

And I've seen no useful or reasonable objections to Viktor's suggestion.

The sixteen bit field harms no one, and when defined and used provides
significant benefit to many.

-JimC
-- 
James Cloos <[email-masked]>         OpenPGP: 0x997A9F17ED7DAEA6

---

From: Melinda Shore <[email-masked]>
Date: Wed, 16 May 2018 14:27:28 -0800

> significant benefit to many.

It is one of the peculiarities of the IETF (and engineers
in general, I guess) that when we sit down to design a
protocol most people will start talking about data formats,
etc. rather than protocol semantics.  Allow me to suggest
that that's a mistake, and that data formats are secondary
to the behavior we expect from a protocol and to the data
needed to support that behavior.  Don't make that mistake
here.

And again, nobody has said that they intend to implement
the proposed mechanism - indeed, when asked, people have
said that they won't.  So I'm not really clear on the
benefit.

I'm compromising as a process matter (this needs to get
done) and because it's clear that nobody else will.

Melinda

-- 
Software longa, hardware brevis

PGP fingerprint: 4F68 2D93 2A17 96F8 20F2
                 34C0 DFB8 9172 9A76 DB8F

---

From: Peter Gutmann <[email-masked]>
Date: Thu, 17 May 2018 05:31:52 +0000

Melinda Shore <[email-masked]> writes:

>And again, nobody has said that they intend to implement the proposed 
>mechanism - indeed, when asked, people have said that they won't. 

Doesn't that resolve the issue then?  If no-one's going to implement it 
then it doesn't matter how many bits you use.  Make it one bit, 128 bits,
-1 bits, e^i{pi} bits, it won't matter.

In fact, you could leave the whole RFC blank except for the title, to save
anyone having to sit down and write it.  Like this paper:

https://arxiv.org/abs/1603.09526

Peter.

---

From: Viktor Dukhovni <[email-masked]>
Date: Thu, 17 May 2018 01:51:45 -0400

> On May 17, 2018, at 1:31 AM, Peter Gutmann <[email-masked]> wrote:
> 

The claim that nobody's going to implement is an expression of frustration,
undoubtedly earned, but not a statement of fact.  While no major browser is
champing at the bit to adopt this extension we will be making a more modest
start in other areas in the not too distant future.

DANE for MTA-to-MTA did not happen until until ~2 years after the ink was
dry on RFC6698.  And yet today we have 209k domains and growing with DANE
TLSA records for their mail server, support for spec in Postfix, Exim,
Halon, MailChannels, Cisco ESA (formerly Ironport) has DANE support in beta,
...  Some things take time.

Here, the objective is to not close the door on the original scope of the
document by limiting the design to just the use-case of the its initial
application.

-- 
	Viktor.

---

From: Tim Hollebeek <[email-masked]>
Date: Thu, 17 May 2018 23:44:38 +0000

Making things more complicated with no obvious benefit just makes things
more complicated.

I oppose adding two bytes for some nebulous future purpose.

-Tim

> -----Original Message-----
> From: TLS [mailto:[email-masked]] On Behalf Of James Cloos
> Sent: Wednesday, May 16, 2018 6:20 PM
> To: Ted Lemon <[email-masked]>
> Cc: <[email-masked]> <[email-masked]>
> Subject: Re: [TLS] TLS DNSSEC chain consensus text, please speak up...
>

---

From: Paul Wouters <[email-masked]>
Date: Thu, 17 May 2018 20:17:41 -0400

> On May 17, 2018, at 19:44, Tim Hollebeek <[email-masked]> wrote:
> 

The consequence of this opinion would be this:

https://tools.ietf.org/html/draft-asmithee-tls-dnssec-downprot-00

Which is a lot of complexity for one TLS extension to define the behaviour of another TLS extension. And it still adds two bytes in the 2nd extension.

So if you believe more simplicity is better, then you made the wrong choice.

Paul

---

From: Tim Hollebeek <[email-masked]>
Date: Fri, 18 May 2018 00:20:26 +0000

I’m actually fine with that.  You have to consider P_{extension implemented and used}.

Different people will disagree about the value of P.

-Tim

From: Paul Wouters [mailto:[email-masked]] 
Sent: Thursday, May 17, 2018 8:18 PM
To: Tim Hollebeek <[email-masked]>
Cc: James Cloos <[email-masked]>; Ted Lemon <[email-masked]>; <[email-masked]> <[email-masked]>
Subject: Re: [TLS] TLS DNSSEC chain consensus text, please speak up...

On May 17, 2018, at 19:44, Tim Hollebeek <[email-masked] <mailto:[email-masked]> > wrote:

 

Paul

---

From: Melinda Shore <[email-masked]>
Date: Thu, 17 May 2018 17:20:53 -0800

And to be clear, it's not that nobody is going to implement the extension
(it's already been done in an IETF hackathon and elsewhere), the work on
the extension was funded by Mozilla, and there's been an outstanding
request for this in Bugzilla.  What's not being implemented is the proposed
changes.

But, it's clear that those guys don't intend to compromise and we're going
to be deadlocked pretty much forever unless someone does something.  That's
not going to be Viktor and it's not going to be the chairs, so I guess it's
me.

Melinda

On Thu, May 17, 2018, 16:20 Tim Hollebeek <[email-masked]>
wrote:

> *From:* Paul Wouters [mailto:[email-masked]]
> *Sent:* Thursday, May 17, 2018 8:18 PM
> *To:* Tim Hollebeek <[email-masked]>
> *Cc:* James Cloos <[email-masked]>; Ted Lemon <[email-masked]>; <
> [email-masked]> <[email-masked]>
> *Subject:* Re: [TLS] TLS DNSSEC chain consensus text, please speak up...
>
>
>
>
>
> Which is a lot of complexity for one TLS extension to define the behaviour
> of another TLS extension. And it still adds two bytes in the 2nd extension.
>
>
>

---

From: Tim Hollebeek <[email-masked]>
Date: Fri, 18 May 2018 01:25:04 +0000

I think there’s room for two people in front of the steamroller.  And I have a towel.  How many votes does that get me?

-Tim

From: Melinda Shore [mailto:[email-masked]] 
Sent: Thursday, May 17, 2018 9:21 PM
To: Tim Hollebeek <[email-masked]>
Cc: Paul Wouters <[email-masked]>; <[email-masked]> <[email-masked]>
Subject: Re: [TLS] TLS DNSSEC chain consensus text, please speak up...

And to be clear, it's not that nobody is going to implement the extension (it's already been done in an IETF hackathon and elsewhere), the work on the extension was funded by Mozilla, and there's been an outstanding request for this in Bugzilla.  What's not being implemented is the proposed changes.

But, it's clear that those guys don't intend to compromise and we're going to be deadlocked pretty much forever unless someone does something.  That's not going to be Viktor and it's not going to be the chairs, so I guess it's me.  

Melinda

On Thu, May 17, 2018, 16:20 Tim Hollebeek <[email-masked] <mailto:[email-masked]> > wrote:

-Tim

From: Paul Wouters [mailto:[email-masked] <mailto:[email-masked]> ] 
Sent: Thursday, May 17, 2018 8:18 PM
To: Tim Hollebeek <[email-masked] <mailto:[email-masked]> >
Cc: James Cloos <[email-masked] <mailto:[email-masked]> >; Ted Lemon <[email-masked] <mailto:[email-masked]> >; <[email-masked] <mailto:[email-masked]> > <[email-masked] <mailto:[email-masked]> >
Subject: Re: [TLS] TLS DNSSEC chain consensus text, please speak up...

 

Paul

_______________________________________________
TLS mailing list
[email-masked] <mailto:[email-masked]> 
https://www.ietf.org/mailman/listinfo/tls