Subject: FW: [Acme] Draft Minutes (and Memes)

From: "Salz, Rich" <[email-masked]>
Date: Thu, 17 Nov 2016 01:50:49 +0000

Thanks to Ted, ACME tried an experiment this time – minutes as/with MEME’s.  As the old English saying goes, “a picture is worth a thousand words.”

Perhaps other groups might want to adopt this in the future.

--
Senior Architect, Akamai Technologies
Member, OpenSSL Dev Team
IM: [email-masked] Twitter: RichSalz

From: Ted Hardie [mailto:[email-masked]]
Sent: Thursday, November 17, 2016 10:18 AM
To: [email-masked]
Subject: [Acme] Draft Minutes (and Memes)

Here are the draft minutes from this week's meeting.  Please review and provide updates and corrections to the list.
Thanks
Ted

ACME IETF 97

Chairs: Rich Salz, Ted Hardie

Scribe: Martin Thomson

Meetecho recording: http://recs.conf.meetecho.com/Playout/watch.jsp?recording=IETF97_ACME&chapter=chapter_1<https://urldefense.proofpoint.com/v2/url?u=http-3A__recs.conf.meetecho.com_Playout_watch.jsp-3Frecording-3DIETF97-5FACME-26chapter-3Dchapter-5F1&d=DgMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=n1Op1FcOTLdwlzb0IZ43iOhkql7o5pTZNFtdZp8B6x8&s=cp8ye9x4bugp9_zW14Vmg8a62wov_PbCMbqpwBYIRJw&e=>

After Administrivia, the Richard Barnes led the group in a review of the closed and open issues of version 4 of the draft (https://datatracker.ietf.org/doc/draft-ietf-acme-acme/<https://urldefense.proofpoint.com/v2/url?u=https-3A__datatracker.ietf.org_doc_draft-2Dietf-2Dacme-2Dacme_&d=DgMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=n1Op1FcOTLdwlzb0IZ43iOhkql7o5pTZNFtdZp8B6x8&s=R-syjef-uWrnraT7s-d_u2afn5RoKSTsfxvVjGQcdXw&e=>).  His slides are here: https://www.ietf.org/proceedings/97/slides/slides-97-acme-acme-protocol-spec-01.pdf<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_proceedings_97_slides_slides-2D97-2Dacme-2Dacme-2Dprotocol-2Dspec-2D01.pdf&d=DgMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=n1Op1FcOTLdwlzb0IZ43iOhkql7o5pTZNFtdZp8B6x8&s=CX_7II--KKlKs1kUdxwuzCTw4mopp17K_QQLoeZR6D4&e=>

The discussion was captured by Martin in MEME form: http://memedad.com/memes/1030645.jpg<https://urldefense.proofpoint.com/v2/url?u=http-3A__memedad.com_memes_1030645.jpg&d=DgMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=n1Op1FcOTLdwlzb0IZ43iOhkql7o5pTZNFtdZp8B6x8&s=SdBZpGVxqcOy7A4LIXd9T-e15LOm2EWdrGMdIXDQuTI&e=> &  http://memedad.com/memes/1030646.jpg<https://urldefense.proofpoint.com/v2/url?u=http-3A__memedad.com_memes_1030646.jpg&d=DgMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=n1Op1FcOTLdwlzb0IZ43iOhkql7o5pTZNFtdZp8B6x8&s=v-ta1EZBBUJMHkXVtkSmJOrVk33N2WEY23lhTuk7E2M&e=>

Richard noted that most of the issues were closed late in the cycle: http://memedad.com/memes/1030647.jpg<https://urldefense.proofpoint.com/v2/url?u=http-3A__memedad.com_memes_1030647.jpg&d=DgMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=n1Op1FcOTLdwlzb0IZ43iOhkql7o5pTZNFtdZp8B6x8&s=Br10Zdg7T__Eo3cxPktreo0R3jjYUa32kG0A0d4tXfw&e=>

There was no discussion of the typos, or clarifications, in the developer friendliness-related updates, content negotiation was added: http://memedad.com/memes/1030648.jpg<https://urldefense.proofpoint.com/v2/url?u=http-3A__memedad.com_memes_1030648.jpg&d=DgMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=n1Op1FcOTLdwlzb0IZ43iOhkql7o5pTZNFtdZp8B6x8&s=MhDMpEdy73gxDchZHICHtwLX9tt0WmUiLQ3hJ-XZ6OA&e=> and PEM with chain made the default: http://memedad.com/meme/1030649<https://urldefense.proofpoint.com/v2/url?u=http-3A__memedad.com_meme_1030649&d=DgMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=n1Op1FcOTLdwlzb0IZ43iOhkql7o5pTZNFtdZp8B6x8&s=BJ6nN1jnDEzOWDP71NHeAMgq3rmVTsoIOn6WGwBoxOU&e=>

The ToS of service flow has also been simplified: http://memedad.com/memes/1030650.jpg<https://urldefense.proofpoint.com/v2/url?u=http-3A__memedad.com_memes_1030650.jpg&d=DgMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=n1Op1FcOTLdwlzb0IZ43iOhkql7o5pTZNFtdZp8B6x8&s=Cbsx2dB_47vMl4Eb2NUOlamSPL_O14psNFHBte_lakg&e=> even in the case where re-agreement is not required: http://memedad.com/memes/1030652.jpg<https://urldefense.proofpoint.com/v2/url?u=http-3A__memedad.com_memes_1030652.jpg&d=DgMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=n1Op1FcOTLdwlzb0IZ43iOhkql7o5pTZNFtdZp8B6x8&s=iX5gVN9Gek7cOc8WvQtT74g3qPodJ_bRER9PrwEOgaE&e=>

The group agreed to replace the current Agreement with Action Required http://memedad.com/memes/1030654.jpg<https://urldefense.proofpoint.com/v2/url?u=http-3A__memedad.com_memes_1030654.jpg&d=DgMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=n1Op1FcOTLdwlzb0IZ43iOhkql7o5pTZNFtdZp8B6x8&s=qBT0tB9q-eDnCTBAE57SLxsW7cfzM1H-XLN9TIoFhIQ&e=> to better align the two.

The group then reviewed the simplifications related to Key Rollover: http://memedad.com/memes/1030656.jpg<https://urldefense.proofpoint.com/v2/url?u=http-3A__memedad.com_memes_1030656.jpg&d=DgMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=n1Op1FcOTLdwlzb0IZ43iOhkql7o5pTZNFtdZp8B6x8&s=LQ7cv3O9aS0dS6TdcK-x1QfPzsmLkYcIJgYDDHqTJ6c&e=>,  http://memedad.com/memes/1030658.jpg<https://urldefense.proofpoint.com/v2/url?u=http-3A__memedad.com_memes_1030658.jpg&d=DgMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=n1Op1FcOTLdwlzb0IZ43iOhkql7o5pTZNFtdZp8B6x8&s=tn3aJthf6vAHU7OQkGmqluUH5k42Cy3RU_5Y7YUzzAs&e=>,

http://memedad.com/memes/1030659.jpg<https://urldefense.proofpoint.com/v2/url?u=http-3A__memedad.com_memes_1030659.jpg&d=DgMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=n1Op1FcOTLdwlzb0IZ43iOhkql7o5pTZNFtdZp8B6x8&s=--B1hfkeNcynQs_k8_Z7BeQw9z9IcZXNCWQ178CNYwA&e=>

The group then reviewed open issues.

  Account Management

  #170 & #172 address this.

  http://memedad.com/memes/1030662.jpg<https://urldefense.proofpoint.com/v2/url?u=http-3A__memedad.com_memes_1030662.jpg&d=DgMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=n1Op1FcOTLdwlzb0IZ43iOhkql7o5pTZNFtdZp8B6x8&s=q-R_FrplbCGV-AeRfdaUYbbDPcx8UdmiH_emgeGi-ZY&e=>

  We may need security considerations recommending counter signing, to avoid UKS-like risks.

  http://memedad.com/memes/1030663.jpg<https://urldefense.proofpoint.com/v2/url?u=http-3A__memedad.com_memes_1030663.jpg&d=DgMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=n1Op1FcOTLdwlzb0IZ43iOhkql7o5pTZNFtdZp8B6x8&s=C_fLQ2zLuPvifvFaVEdgt-Oncb6XSn24PHJNF6YWHVw&e=>

<https://urldefense.proofpoint.com/v2/url?u=http-3A__memedad.com_memes_1030663.jpg&d=DgMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=n1Op1FcOTLdwlzb0IZ43iOhkql7o5pTZNFtdZp8B6x8&s=C_fLQ2zLuPvifvFaVEdgt-Oncb6XSn24PHJNF6YWHVw&e=>

  Clint Wilson from digicert confirmed that this was useable for their needs.  They need to include a field that allows them specify the ACME key.  Martin noted that you need to prove that you hold the private key for that ACME key--possibly a jws field.   Martin and Richard will work together to get a solution proposed, possibly based on Mozilla’s push.  http://memedad.com/memes/1030665.jpg<https://urldefense.proofpoint.com/v2/url?u=http-3A__memedad.com_memes_1030665.jpg&d=DgMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=n1Op1FcOTLdwlzb0IZ43iOhkql7o5pTZNFtdZp8B6x8&s=e5BE2jxwTncBGNrNPVhPJeHiqJlm9BkGm8r7b9tVNWM&e=>.  From the floor, Rich Salz noted that it’s an API key, so the security considerations are basically those of any other API key; we likely don’t need to say more than that.

  Additional CA Account Data

  How to provide additional data

  http://memedad.com/memes/1030666.jpg<https://urldefense.proofpoint.com/v2/url?u=http-3A__memedad.com_memes_1030666.jpg&d=DgMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=n1Op1FcOTLdwlzb0IZ43iOhkql7o5pTZNFtdZp8B6x8&s=3J2akblwyAbQXCDVn87dYItNaSW_O7C0yqX4rFxq-ps&e=>

  Working group polled on what to do?

Martin:  this is just another form of the x- thing; this is bucket of things that might be useful.  If useful for one, likely generally useful. Accepted wisdom is that we define these in the free form text fields that we already have.  We don’t need a special bucket.  Required extensions are a special problem that CAs create for themselves--we do have a mechanism for protecting the semantics (the version). [Toss these in the top level, in other words, don’t make these extensions]. Clint agreed.

   http://memedad.com/memes/1030668.jpg<https://urldefense.proofpoint.com/v2/url?u=http-3A__memedad.com_memes_1030668.jpg&d=DgMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=n1Op1FcOTLdwlzb0IZ43iOhkql7o5pTZNFtdZp8B6x8&s=b9uvdyS4jRBAGWdcsg-foCy2GRairr4nvGywnWYVfzA&e=>

We can avoid collision by creating a registry with very simple addition rules.

  http://memedad.com/memes/1030670.jpg<https://urldefense.proofpoint.com/v2/url?u=http-3A__memedad.com_memes_1030670.jpg&d=DgMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=n1Op1FcOTLdwlzb0IZ43iOhkql7o5pTZNFtdZp8B6x8&s=vOcWoSiSzp60zgxRXN0OK00eQxL10-x8F6zPgsTkUuw&e=> &  http://memedad.com/memes/1030672.jpg<https://urldefense.proofpoint.com/v2/url?u=http-3A__memedad.com_memes_1030672.jpg&d=DgMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=n1Op1FcOTLdwlzb0IZ43iOhkql7o5pTZNFtdZp8B6x8&s=tEa1XqJavJj6k5Rkf9e-KT_H7LjPM-4P1pJx6pHTapU&e=>

 Object Model

  #195  Combine “requirements” and “authorizations”.

  http://memedad.com/memes/1030673.jpg<https://urldefense.proofpoint.com/v2/url?u=http-3A__memedad.com_memes_1030673.jpg&d=DgMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=n1Op1FcOTLdwlzb0IZ43iOhkql7o5pTZNFtdZp8B6x8&s=WsIVF7FOWdtgGqFkzDl5sTlwbyytbtOAw50kD_CvjpM&e=>

  This proposal removes requirements and oob, and use only authorization.

   http://memedad.com/memes/1030674.jpg<https://urldefense.proofpoint.com/v2/url?u=http-3A__memedad.com_memes_1030674.jpg&d=DgMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=n1Op1FcOTLdwlzb0IZ43iOhkql7o5pTZNFtdZp8B6x8&s=78gR4KTKVI9fJWkaW3e3OgoaGVes0qBSyfArEyWFwjg&e=>

   Martin is okay with the new structure (Before & After slide), but the non-exploded version might have only a status field and series of URLs.  EKR asks if this applies to the case where a CSR has already been sent?  Yes, that’s right.

http://memedad.com/memes/1030678.jpg<https://urldefense.proofpoint.com/v2/url?u=http-3A__memedad.com_memes_1030678.jpg&d=DgMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=n1Op1FcOTLdwlzb0IZ43iOhkql7o5pTZNFtdZp8B6x8&s=Os1A33vPpcdx-h8RnMyZueJWl6un1aN5KUIB5ubBmOo&e=>

   Bike Shed Terminology changes

    application→ order

    registration→ account

http://memedad.com/memes/1030676.jpg<https://urldefense.proofpoint.com/v2/url?u=http-3A__memedad.com_memes_1030676.jpg&d=DgMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=n1Op1FcOTLdwlzb0IZ43iOhkql7o5pTZNFtdZp8B6x8&s=IhhFbQ21KmZ2qcWEWHHPbKlKL0PXGDWFE3oPImHMtwE&e=>

Where do we go?

WGLC to get a stable version as an interop target

http://memedad.com/memes/1030681.jpg<https://urldefense.proofpoint.com/v2/url?u=http-3A__memedad.com_memes_1030681.jpg&d=DgMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=n1Op1FcOTLdwlzb0IZ43iOhkql7o5pTZNFtdZp8B6x8&s=2TzQ2WY144oNFHhBlNANBBLILNrg4aJOFLZod3QM2qo&e=>

http://memedad.com/memes/1030686.jpg<https://urldefense.proofpoint.com/v2/url?u=http-3A__memedad.com_memes_1030686.jpg&d=DgMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=n1Op1FcOTLdwlzb0IZ43iOhkql7o5pTZNFtdZp8B6x8&s=IIL0qsCF7h__hq5fjwvAqfrpiv4GQLcWCty_l_M20K0&e=>

Yaron Sheffer, short term certs (LURK BoF)

Describes alternative approaches: online oracle, short term cert delegation.

http://memedad.com/meme/1030689<https://urldefense.proofpoint.com/v2/url?u=http-3A__memedad.com_meme_1030689&d=DgMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=n1Op1FcOTLdwlzb0IZ43iOhkql7o5pTZNFtdZp8B6x8&s=i06pXmBNQW-Z0G5FIL1zUf_gsJkLJyiRLt_Zy2-1r1o&e=>

This iteration follows on from the LURK BoF, but there have been some changes to the proposal.

http://memedad.com/meme/1030692<https://urldefense.proofpoint.com/v2/url?u=http-3A__memedad.com_meme_1030692&d=DgMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=n1Op1FcOTLdwlzb0IZ43iOhkql7o5pTZNFtdZp8B6x8&s=WA11QQixYcqoNRCQU69G6Oxq41XmOLudKYc8A7vKcrE&e=>

DNO and CDN create a mutually authenticated channel and agree on a CSR for the short term validity certs.  DNO registers with an ACME server.

Bootstrap phase:  CDN creats the CSR, the DNO validates it, then the DNO sends it to the ACME server, requesting a short-term certificate.  The DNO has to do any of the issuance checks.  Gets back the certificate URL, then sends it on to the CDN.  The ACME server periodically renews the certificate, and the CDN retrieves it.

No explicit X.509-style revocation, but instead tells the ACME to stop renewing.

http://www.simplehrguide.com/assets/images/recruitment-flowchart.jpg<https://urldefense.proofpoint.com/v2/url?u=http-3A__www.simplehrguide.com_assets_images_recruitment-2Dflowchart.jpg&d=DgMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=n1Op1FcOTLdwlzb0IZ43iOhkql7o5pTZNFtdZp8B6x8&s=MDDHyD_CRixIpnb-3T8wu0gMTa8kgOBWrs1r8NQlp34&e=>

Security Considerations; basically say that the CDN does not own the relevant DNS zone; also requires CAA record be respected:

http://memedad.com/memes/1030698.jpg<https://urldefense.proofpoint.com/v2/url?u=http-3A__memedad.com_memes_1030698.jpg&d=DgMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=n1Op1FcOTLdwlzb0IZ43iOhkql7o5pTZNFtdZp8B6x8&s=-eedIAa218K1t0v_yuHD8k90_TIc6SwVC95pYrqyM2Y&e=>

Also caaa-01 to restrict ACME checks to DNS authorization only

Why not use the standard split client model?

http://memedad.com/meme/1030699<https://urldefense.proofpoint.com/v2/url?u=http-3A__memedad.com_meme_1030699&d=DgMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=n1Op1FcOTLdwlzb0IZ43iOhkql7o5pTZNFtdZp8B6x8&s=IATEhSKJVxbvOJaYpNxA2LUgqyj2qV1_k3dYQekL30Q&e=>

Nick Sullivan (CloudFlare)

DNS is operated by the CDN; it’s a common use case for them to be the same, so limiting to DNS authorization will not provide the the security considered.

http://memedad.com/memes/1030702.jpg<https://urldefense.proofpoint.com/v2/url?u=http-3A__memedad.com_memes_1030702.jpg&d=DgMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=n1Op1FcOTLdwlzb0IZ43iOhkql7o5pTZNFtdZp8B6x8&s=wsI2hDemsG1novLkUnW4QY2vgFHnMOByw_660UAIaqM&e=>

CT could use separate short-term logs rather than mingle them with long-lived certificates.  DKG points out that this pushes the problem into a different operational tradeoff.

http://memedad.com/memes/1030707.jpg<https://urldefense.proofpoint.com/v2/url?u=http-3A__memedad.com_memes_1030707.jpg&d=DgMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=n1Op1FcOTLdwlzb0IZ43iOhkql7o5pTZNFtdZp8B6x8&s=3eMnBwpfxw7KY9GEDZW2VN9lx8byz1TV7Qp13TW674E&e=>

CAA

5 new victims agreed to read the doc.

STIR

http://memedad.com/meme/1030709<https://urldefense.proofpoint.com/v2/url?u=http-3A__memedad.com_meme_1030709&d=DgMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=n1Op1FcOTLdwlzb0IZ43iOhkql7o5pTZNFtdZp8B6x8&s=T4rBSGk7U_9IPAdUxsOD3xwLCl5EB86prlGNYHxuS1M&e=>

http://memedad.com/meme/1030710<https://urldefense.proofpoint.com/v2/url?u=http-3A__memedad.com_meme_1030710&d=DgMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=n1Op1FcOTLdwlzb0IZ43iOhkql7o5pTZNFtdZp8B6x8&s=9mq93DJ2m_zXDdbqgAc3DQNiwA3FiehJplidzQwH7ig&e=>

http://memedad.com/memes/1030712.jpg<https://urldefense.proofpoint.com/v2/url?u=http-3A__memedad.com_memes_1030712.jpg&d=DgMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=n1Op1FcOTLdwlzb0IZ43iOhkql7o5pTZNFtdZp8B6x8&s=RJVWyoA6IqTK2o6OCus83UzU7vZiR3pmVMqb7UNd0z0&e=>

Recharter discussion on the list between the new year and March

http://memedad.com/memes/1030713.jpg<https://urldefense.proofpoint.com/v2/url?u=http-3A__memedad.com_memes_1030713.jpg&d=DgMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=n1Op1FcOTLdwlzb0IZ43iOhkql7o5pTZNFtdZp8B6x8&s=EyAO5PontwuMzXg8mcj9Eu0ftDiwdTNhminf7jYGUSY&e=>

---

From: Mary Barnes <[email-masked]>
Date: Wed, 16 Nov 2016 21:01:07 -0600

I think it's a good way to get people to read your minutes.  My favorite
from that session is this one ;)
http://memedad.com/meme/1030710

Regards,
Mary.

On Wed, Nov 16, 2016 at 7:50 PM, Salz, Rich <[email-masked]> wrote:

> Thanks to Ted, ACME tried an experiment this time – minutes as/with
> MEME’s.  As the old English saying goes, “a picture is worth a thousand
> words.”
>
>
>
> *From:* Ted Hardie [mailto:[email-masked]]
> *Sent:* Thursday, November 17, 2016 10:18 AM
> *To:* [email-masked]
> *Subject:* [Acme] Draft Minutes (and Memes)
>
>
>
> Here are the draft minutes from this week's meeting.  Please review and
> provide updates and corrections to the list.
>
> Thanks
>
> Ted
>
>
> ACME IETF 97
>
> Meetecho recording: http://recs.conf.meetecho.com/
> Playout/watch.jsp?recording=IETF97_ACME&chapter=chapter_1
> <https://urldefense.proofpoint.com/v2/url?u=http-3A__recs.conf.meetecho.com_Playout_watch.jsp-3Frecording-3DIETF97-5FACME-26chapter-3Dchapter-5F1&d=DgMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=n1Op1FcOTLdwlzb0IZ43iOhkql7o5pTZNFtdZp8B6x8&s=cp8ye9x4bugp9_zW14Vmg8a62wov_PbCMbqpwBYIRJw&e=>
>
>
>
> After Administrivia, the Richard Barnes led the group in a review of the
> closed and open issues of version 4 of the draft (
> https://datatracker.ietf.org/doc/draft-ietf-acme-acme/
> <https://urldefense.proofpoint.com/v2/url?u=https-3A__datatracker.ietf.org_doc_draft-2Dietf-2Dacme-2Dacme_&d=DgMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=n1Op1FcOTLdwlzb0IZ43iOhkql7o5pTZNFtdZp8B6x8&s=R-syjef-uWrnraT7s-d_u2afn5RoKSTsfxvVjGQcdXw&e=>).
> His slides are here: https://www.ietf.org/proceedings/97/slides/slides-
> 97-acme-acme-protocol-spec-01.pdf
> <https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_proceedings_97_slides_slides-2D97-2Dacme-2Dacme-2Dprotocol-2Dspec-2D01.pdf&d=DgMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=n1Op1FcOTLdwlzb0IZ43iOhkql7o5pTZNFtdZp8B6x8&s=CX_7II--KKlKs1kUdxwuzCTw4mopp17K_QQLoeZR6D4&e=>
>
>
>
> The discussion was captured by Martin in MEME form:
> http://memedad.com/memes/1030645.jpg
> <https://urldefense.proofpoint.com/v2/url?u=http-3A__memedad.com_memes_1030645.jpg&d=DgMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=n1Op1FcOTLdwlzb0IZ43iOhkql7o5pTZNFtdZp8B6x8&s=SdBZpGVxqcOy7A4LIXd9T-e15LOm2EWdrGMdIXDQuTI&e=>
> &  http://memedad.com/memes/1030646.jpg
> <https://urldefense.proofpoint.com/v2/url?u=http-3A__memedad.com_memes_1030646.jpg&d=DgMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=n1Op1FcOTLdwlzb0IZ43iOhkql7o5pTZNFtdZp8B6x8&s=v-ta1EZBBUJMHkXVtkSmJOrVk33N2WEY23lhTuk7E2M&e=>
>
>
>
> Richard noted that most of the issues were closed late in the cycle:
> http://memedad.com/memes/1030647.jpg
> <https://urldefense.proofpoint.com/v2/url?u=http-3A__memedad.com_memes_1030647.jpg&d=DgMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=n1Op1FcOTLdwlzb0IZ43iOhkql7o5pTZNFtdZp8B6x8&s=Br10Zdg7T__Eo3cxPktreo0R3jjYUa32kG0A0d4tXfw&e=>
>
>
>
> There was no discussion of the typos, or clarifications, in the developer
> friendliness-related updates, content negotiation was added:
> http://memedad.com/memes/1030648.jpg
> <https://urldefense.proofpoint.com/v2/url?u=http-3A__memedad.com_memes_1030648.jpg&d=DgMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=n1Op1FcOTLdwlzb0IZ43iOhkql7o5pTZNFtdZp8B6x8&s=MhDMpEdy73gxDchZHICHtwLX9tt0WmUiLQ3hJ-XZ6OA&e=>
> and PEM with chain made the default: http://memedad.com/meme/1030649
> <https://urldefense.proofpoint.com/v2/url?u=http-3A__memedad.com_meme_1030649&d=DgMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=n1Op1FcOTLdwlzb0IZ43iOhkql7o5pTZNFtdZp8B6x8&s=BJ6nN1jnDEzOWDP71NHeAMgq3rmVTsoIOn6WGwBoxOU&e=>
>
>
>
> The ToS of service flow has also been simplified:
> http://memedad.com/memes/1030650.jpg
> <https://urldefense.proofpoint.com/v2/url?u=http-3A__memedad.com_memes_1030650.jpg&d=DgMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=n1Op1FcOTLdwlzb0IZ43iOhkql7o5pTZNFtdZp8B6x8&s=Cbsx2dB_47vMl4Eb2NUOlamSPL_O14psNFHBte_lakg&e=>
> even in the case where re-agreement is not required:
> http://memedad.com/memes/1030652.jpg
> <https://urldefense.proofpoint.com/v2/url?u=http-3A__memedad.com_memes_1030652.jpg&d=DgMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=n1Op1FcOTLdwlzb0IZ43iOhkql7o5pTZNFtdZp8B6x8&s=iX5gVN9Gek7cOc8WvQtT74g3qPodJ_bRER9PrwEOgaE&e=>
>
>
>
> The group agreed to replace the current Agreement with Action Required
> http://memedad.com/memes/1030654.jpg
> <https://urldefense.proofpoint.com/v2/url?u=http-3A__memedad.com_memes_1030654.jpg&d=DgMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=n1Op1FcOTLdwlzb0IZ43iOhkql7o5pTZNFtdZp8B6x8&s=qBT0tB9q-eDnCTBAE57SLxsW7cfzM1H-XLN9TIoFhIQ&e=>
> to better align the two.
>
>
>
> The group then reviewed the simplifications related to Key Rollover:
> http://memedad.com/memes/1030656.jpg
> <https://urldefense.proofpoint.com/v2/url?u=http-3A__memedad.com_memes_1030656.jpg&d=DgMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=n1Op1FcOTLdwlzb0IZ43iOhkql7o5pTZNFtdZp8B6x8&s=LQ7cv3O9aS0dS6TdcK-x1QfPzsmLkYcIJgYDDHqTJ6c&e=>,
>  http://memedad.com/memes/1030658.jpg
> <https://urldefense.proofpoint.com/v2/url?u=http-3A__memedad.com_memes_1030658.jpg&d=DgMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=n1Op1FcOTLdwlzb0IZ43iOhkql7o5pTZNFtdZp8B6x8&s=tn3aJthf6vAHU7OQkGmqluUH5k42Cy3RU_5Y7YUzzAs&e=>
> ,
>
> http://memedad.com/memes/1030659.jpg
> <https://urldefense.proofpoint.com/v2/url?u=http-3A__memedad.com_memes_1030659.jpg&d=DgMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=n1Op1FcOTLdwlzb0IZ43iOhkql7o5pTZNFtdZp8B6x8&s=--B1hfkeNcynQs_k8_Z7BeQw9z9IcZXNCWQ178CNYwA&e=>
>
>
>
>   http://memedad.com/memes/1030662.jpg
> <https://urldefense.proofpoint.com/v2/url?u=http-3A__memedad.com_memes_1030662.jpg&d=DgMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=n1Op1FcOTLdwlzb0IZ43iOhkql7o5pTZNFtdZp8B6x8&s=q-R_FrplbCGV-AeRfdaUYbbDPcx8UdmiH_emgeGi-ZY&e=>
>
>   http://memedad.com/memes/1030663.jpg
>   Clint Wilson from digicert confirmed that this was useable for their
> needs.  They need to include a field that allows them specify the ACME
> key.  Martin noted that you need to prove that you hold the private key for
> that ACME key--possibly a jws field.   Martin and Richard will work
> together to get a solution proposed, possibly based on Mozilla’s push.
> http://memedad.com/memes/1030665.jpg
> <https://urldefense.proofpoint.com/v2/url?u=http-3A__memedad.com_memes_1030665.jpg&d=DgMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=n1Op1FcOTLdwlzb0IZ43iOhkql7o5pTZNFtdZp8B6x8&s=e5BE2jxwTncBGNrNPVhPJeHiqJlm9BkGm8r7b9tVNWM&e=>.
> From the floor, Rich Salz noted that it’s an API key, so the security
> considerations are basically those of any other API key; we likely don’t
> need to say more than that.
>
>
>
>   http://memedad.com/memes/1030666.jpg
> <https://urldefense.proofpoint.com/v2/url?u=http-3A__memedad.com_memes_1030666.jpg&d=DgMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=n1Op1FcOTLdwlzb0IZ43iOhkql7o5pTZNFtdZp8B6x8&s=3J2akblwyAbQXCDVn87dYItNaSW_O7C0yqX4rFxq-ps&e=>
>
> Martin:  this is just another form of the x- thing; this is bucket of
> things that might be useful.  If useful for one, likely generally useful.
> Accepted wisdom is that we define these in the free form text fields that
> we already have.  We don’t need a special bucket.  Required extensions are
> a special problem that CAs create for themselves--we do have a mechanism
> for protecting the semantics (the version). [Toss these in the top level,
> in other words, don’t make these extensions]. Clint agreed.
>
>    http://memedad.com/memes/1030668.jpg
> <https://urldefense.proofpoint.com/v2/url?u=http-3A__memedad.com_memes_1030668.jpg&d=DgMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=n1Op1FcOTLdwlzb0IZ43iOhkql7o5pTZNFtdZp8B6x8&s=b9uvdyS4jRBAGWdcsg-foCy2GRairr4nvGywnWYVfzA&e=>
>
>   http://memedad.com/memes/1030670.jpg
> <https://urldefense.proofpoint.com/v2/url?u=http-3A__memedad.com_memes_1030670.jpg&d=DgMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=n1Op1FcOTLdwlzb0IZ43iOhkql7o5pTZNFtdZp8B6x8&s=vOcWoSiSzp60zgxRXN0OK00eQxL10-x8F6zPgsTkUuw&e=>
> &  http://memedad.com/memes/1030672.jpg
> <https://urldefense.proofpoint.com/v2/url?u=http-3A__memedad.com_memes_1030672.jpg&d=DgMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=n1Op1FcOTLdwlzb0IZ43iOhkql7o5pTZNFtdZp8B6x8&s=tEa1XqJavJj6k5Rkf9e-KT_H7LjPM-4P1pJx6pHTapU&e=>
>
>
>
>  Object Model
>
>   http://memedad.com/memes/1030673.jpg
> <https://urldefense.proofpoint.com/v2/url?u=http-3A__memedad.com_memes_1030673.jpg&d=DgMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=n1Op1FcOTLdwlzb0IZ43iOhkql7o5pTZNFtdZp8B6x8&s=WsIVF7FOWdtgGqFkzDl5sTlwbyytbtOAw50kD_CvjpM&e=>
>
>
>
>    http://memedad.com/memes/1030674.jpg
> <https://urldefense.proofpoint.com/v2/url?u=http-3A__memedad.com_memes_1030674.jpg&d=DgMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=n1Op1FcOTLdwlzb0IZ43iOhkql7o5pTZNFtdZp8B6x8&s=78gR4KTKVI9fJWkaW3e3OgoaGVes0qBSyfArEyWFwjg&e=>
>
>    Martin is okay with the new structure (Before & After slide), but the
> non-exploded version might have only a status field and series of URLs.
> EKR asks if this applies to the case where a CSR has already been sent?
> Yes, that’s right.
>
> http://memedad.com/memes/1030678.jpg
> <https://urldefense.proofpoint.com/v2/url?u=http-3A__memedad.com_memes_1030678.jpg&d=DgMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=n1Op1FcOTLdwlzb0IZ43iOhkql7o5pTZNFtdZp8B6x8&s=Os1A33vPpcdx-h8RnMyZueJWl6un1aN5KUIB5ubBmOo&e=>
>
>
>
> http://memedad.com/memes/1030676.jpg
> <https://urldefense.proofpoint.com/v2/url?u=http-3A__memedad.com_memes_1030676.jpg&d=DgMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=n1Op1FcOTLdwlzb0IZ43iOhkql7o5pTZNFtdZp8B6x8&s=IhhFbQ21KmZ2qcWEWHHPbKlKL0PXGDWFE3oPImHMtwE&e=>
>
>
>
> Where do we go?
>
> http://memedad.com/memes/1030681.jpg
> <https://urldefense.proofpoint.com/v2/url?u=http-3A__memedad.com_memes_1030681.jpg&d=DgMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=n1Op1FcOTLdwlzb0IZ43iOhkql7o5pTZNFtdZp8B6x8&s=2TzQ2WY144oNFHhBlNANBBLILNrg4aJOFLZod3QM2qo&e=>
>
> http://memedad.com/memes/1030686.jpg
> <https://urldefense.proofpoint.com/v2/url?u=http-3A__memedad.com_memes_1030686.jpg&d=DgMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=n1Op1FcOTLdwlzb0IZ43iOhkql7o5pTZNFtdZp8B6x8&s=IIL0qsCF7h__hq5fjwvAqfrpiv4GQLcWCty_l_M20K0&e=>
>
>
>
> http://memedad.com/meme/1030689
> <https://urldefense.proofpoint.com/v2/url?u=http-3A__memedad.com_meme_1030689&d=DgMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=n1Op1FcOTLdwlzb0IZ43iOhkql7o5pTZNFtdZp8B6x8&s=i06pXmBNQW-Z0G5FIL1zUf_gsJkLJyiRLt_Zy2-1r1o&e=>
>
> http://memedad.com/meme/1030692
> <https://urldefense.proofpoint.com/v2/url?u=http-3A__memedad.com_meme_1030692&d=DgMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=n1Op1FcOTLdwlzb0IZ43iOhkql7o5pTZNFtdZp8B6x8&s=WA11QQixYcqoNRCQU69G6Oxq41XmOLudKYc8A7vKcrE&e=>
>
> DNO and CDN create a mutually authenticated channel and agree on a CSR for
> the short term validity certs.  DNO registers with an ACME server.
>
> Bootstrap phase:  CDN creats the CSR, the DNO validates it, then the DNO
> sends it to the ACME server, requesting a short-term certificate.  The DNO
> has to do any of the issuance checks.  Gets back the certificate URL, then
> sends it on to the CDN.  The ACME server periodically renews the
> certificate, and the CDN retrieves it.
>
>
>
> http://www.simplehrguide.com/assets/images/recruitment-flowchart.jpg
> <https://urldefense.proofpoint.com/v2/url?u=http-3A__www.simplehrguide.com_assets_images_recruitment-2Dflowchart.jpg&d=DgMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=n1Op1FcOTLdwlzb0IZ43iOhkql7o5pTZNFtdZp8B6x8&s=MDDHyD_CRixIpnb-3T8wu0gMTa8kgOBWrs1r8NQlp34&e=>
>
>
>
> Security Considerations; basically say that the CDN does not own the
> relevant DNS zone; also requires CAA record be respected:
>
>
>
> http://memedad.com/memes/1030698.jpg
> <https://urldefense.proofpoint.com/v2/url?u=http-3A__memedad.com_memes_1030698.jpg&d=DgMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=n1Op1FcOTLdwlzb0IZ43iOhkql7o5pTZNFtdZp8B6x8&s=-eedIAa218K1t0v_yuHD8k90_TIc6SwVC95pYrqyM2Y&e=>
>
>
>
> http://memedad.com/meme/1030699
> <https://urldefense.proofpoint.com/v2/url?u=http-3A__memedad.com_meme_1030699&d=DgMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=n1Op1FcOTLdwlzb0IZ43iOhkql7o5pTZNFtdZp8B6x8&s=IATEhSKJVxbvOJaYpNxA2LUgqyj2qV1_k3dYQekL30Q&e=>
>
>
>
> DNS is operated by the CDN; it’s a common use case for them to be the
> same, so limiting to DNS authorization will not provide the the security
> considered.
>
> http://memedad.com/memes/1030702.jpg
> <https://urldefense.proofpoint.com/v2/url?u=http-3A__memedad.com_memes_1030702.jpg&d=DgMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=n1Op1FcOTLdwlzb0IZ43iOhkql7o5pTZNFtdZp8B6x8&s=wsI2hDemsG1novLkUnW4QY2vgFHnMOByw_660UAIaqM&e=>
>
> CT could use separate short-term logs rather than mingle them with
> long-lived certificates.  DKG points out that this pushes the problem into
> a different operational tradeoff.
>
> http://memedad.com/memes/1030707.jpg
> <https://urldefense.proofpoint.com/v2/url?u=http-3A__memedad.com_memes_1030707.jpg&d=DgMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=n1Op1FcOTLdwlzb0IZ43iOhkql7o5pTZNFtdZp8B6x8&s=3eMnBwpfxw7KY9GEDZW2VN9lx8byz1TV7Qp13TW674E&e=>
>
>
>
> CAA
>
> http://memedad.com/meme/1030709
> <https://urldefense.proofpoint.com/v2/url?u=http-3A__memedad.com_meme_1030709&d=DgMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=n1Op1FcOTLdwlzb0IZ43iOhkql7o5pTZNFtdZp8B6x8&s=T4rBSGk7U_9IPAdUxsOD3xwLCl5EB86prlGNYHxuS1M&e=>
>
> http://memedad.com/meme/1030710
> <https://urldefense.proofpoint.com/v2/url?u=http-3A__memedad.com_meme_1030710&d=DgMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=n1Op1FcOTLdwlzb0IZ43iOhkql7o5pTZNFtdZp8B6x8&s=9mq93DJ2m_zXDdbqgAc3DQNiwA3FiehJplidzQwH7ig&e=>
>
> http://memedad.com/memes/1030712.jpg
> <https://urldefense.proofpoint.com/v2/url?u=http-3A__memedad.com_memes_1030712.jpg&d=DgMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=n1Op1FcOTLdwlzb0IZ43iOhkql7o5pTZNFtdZp8B6x8&s=RJVWyoA6IqTK2o6OCus83UzU7vZiR3pmVMqb7UNd0z0&e=>
>
>
>
> http://memedad.com/memes/1030713.jpg
> <https://urldefense.proofpoint.com/v2/url?u=http-3A__memedad.com_memes_1030713.jpg&d=DgMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=n1Op1FcOTLdwlzb0IZ43iOhkql7o5pTZNFtdZp8B6x8&s=EyAO5PontwuMzXg8mcj9Eu0ftDiwdTNhminf7jYGUSY&e=>
>
>
>
>
>
>
>
>
>
>
>

---

From: Alia Atlas <[email-masked]>
Date: Wed, 16 Nov 2016 22:10:29 -0500

I can't stop laughing - which is unfortunate for focusing on the current
meeting.

What a fun idea - that will make the key points stick in folks heads.  Is
there an .html version so the meme can be easily seen embedded?

On Wed, Nov 16, 2016 at 10:01 PM, Mary Barnes <[email-masked]>
wrote:

>> His slides are here: https://www.ietf.org/proceedin
>> gs/97/slides/slides-97-acme-acme-protocol-spec-01.pdf
>> DNO and CDN create a mutually authenticated channel and agree on a CSR
>> for the short term validity certs.  DNO registers with an ACME server.
>>

---

From: Martin Thomson <[email-masked]>
Date: Thu, 17 Nov 2016 13:36:15 +0900

> there an .html version so the meme can be easily seen embedded?

Maybe the chairs can change the default branch for their materials
repo on github to gh-pages so that we can use the github.io site.

---

From: Ted Hardie <[email-masked]>
Date: Thu, 17 Nov 2016 13:42:27 +0900

Adam pointed out that the memedad links would fail from bit rot.  He
created an inline version.

https://www.dropbox.com/s/75oslbfycd8v35b/acme97-minutes.html

Thanks to both Martin and Adam,

Ted