Subject: RE: Input solicited: IETF problem pinpointing at the plenary?

From: Randy Bush <[email-masked]>
Date: Wed, 30 Oct 2002 06:52:36 -0800

> I suspect that Randy means (he'll correct me if I am wrong):
> 
>   the question that i would ask was why did the security problem NOT come up
>                                                                ======
>   and get solved during the wg internal review or ietf last call?

<blush>  typing late at night at nanog.  sorreeeee

> I think the idea is that these things should be seen/uncovered/discussed
> in the WG or during WG or IETF Last Call, and not at the IESG when they
> have it on their desk. How can we make WGs aware that they must look
> at these things right from the beginning?

the new ietf sport
  o don't be rigorous and diligent in the wg, it's too much like hard work
  o don't bother to seriously review things in last call, the iesg will
    clean up anything dangerous (if they catch it)
  o be shocked and annoyed when the iesg actually tries to be diligent
    when they review the document
  o start a witch-hunt for the iesg member(s) who had the nerve to try
    to clean up after the trail of mediocre diligence

boooooring

randy

---

From: Bill Sommerfeld <[email-masked]>
Date: Wed, 30 Oct 2002 18:56:49 -0500

>    and get solved during the wg internal review or ietf last call?

Regardless of how much due diligence is applied, there's still a
decent chance that someone new will look at it from a slightly
different angle and notice something new which makes the proposal look
like swiss cheese.

It's also often a lot easier to say "here's what's broken" than to
really fix things without introducing more holes.

Security is funny that way.

						- Bill