Subject: [saag] other standards things that are important

From: Stephen Farrell <[email-masked]>
Date: Sun, 01 Apr 2012 13:03:22 +0100

Hiya,

 From time to time we get liaison statements from other
standards groups that ask the IETF to do stuff, e.g. to
go bother a bunch of IETF folks to produce a response
detailing the work being done on topic "foo."

Sean and I would like to get a feeling for how you
perceive those different organisations' work so we
can consume an appropriate amount of effort (ours
and those we hassle) in responding, and on the basis
of something a bit better than just our own hunches
and opinions.

So, I'd appreciate it if you could reply with an email
naming other security related standards development
activities and giving each marks from 10 related to
their importance to the Internet.

Basis of the marks-from-10 is we normalise ourselves
at 5; 1 is really really bad and 10 is the best it
can be. Take into account both technical excellence
and pragmatic importance. Doesn't matter if the
activity concerned is a producer of stuff we use, or
a consumer of our stuff, we may have to deal with
them in any case. Try be as specific as you can, say
at the level equivalent to an IETF WG if possible.

An example response might look like:

w3c xkms 2
ieee 802.1x 7

You can add more detail if you like, and send your mail
to the saag list, or just to Sean and/or I - whatever you
prefer.

Assuming we get enough inputs I'll summarise back to the
list in a bit after anonymising. If we don't get enough
input we'll come back with that news too.

Pleae send any responses you have within one week from
now if possible.

Please start a separate thread if you want to discuss
doing this, the methodology or anything else related
but leave this thread for direct responses with numbers.

Thanks,
S.

PS: I co-chaired xkms for w3c so I know its ok to say
it's not the most important thing out there:-)

PPS: We will of course continue to respond nicely to
whoever liaises with us, but we'd like to know when to
put in the extra effort to do it more than nicely:-)

---

From: Michael Richardson <[email-masked]>
Date: Tue, 03 Apr 2012 09:02:34 -0400

>>>>> "Stephen" == Stephen Farrell <[email-masked]> writes:
    Stephen> From time to time we get liaison statements from other
    Stephen> standards groups that ask the IETF to do stuff, e.g. to go
    Stephen> bother a bunch of IETF folks to produce a response
    Stephen> detailing the work being done on topic "foo."

Any standard that doesn't have an open URL that anyone can read, is not,
in my opinion, a useful standard.   So I regard any entity that wants to
us review their document, so that they can then sell it to people, is
suspect.

In particular, since few run-of-the-mill developers out there will ever
pay to read that document, it's relevance to the internet is almost nil.
(Sure, they might be told, "implement 802.1x" by their boss, but if
given the task of "make sure our product has access control on the
networking", they won't consider technology in documents that they can
not read) 

-- 
]       He who is tired of Weird Al is tired of life!           |  firewalls  [
]   Michael Richardson, Sandelman Software Works, Ottawa, ON    |net architect[
] [email-masked] http://www.sandelman.ottawa.on.ca/ |device driver[
   Kyoto Plus: watch the video <http://www.youtube.com/watch?v=kzx1ycLXQSE>
	               then sign the petition.

---

From: Simon Josefsson <[email-masked]>
Date: Wed, 04 Apr 2012 14:22:52 +0200

Michael Richardson <[email-masked]> writes:

> in my opinion, a useful standard.

+1

Btw, it would make it easier to answer the initial question if we had
the names of at least a few organizations that you were thinking of.

/Simon

---

From: Tina TSOU <[email-masked]>
Date: Wed, 4 Apr 2012 22:45:58 +0000

Sent from my iPad

> networking", they won't consider technology in documents that they can
I did have to read IEEE standard when I implemented 802.1X in the year 2001-2002. To make sure our product has access control on the networking, we created a regional standard version of 802.1X.

---

From: Stephen Farrell <[email-masked]>
Date: Wed, 04 Apr 2012 23:53:33 +0100

On 04/04/2012 01:22 PM, Simon Josefsson wrote:
> Michael Richardson<[email-masked]>  writes:
>
>>>>>>> "Stephen" == Stephen Farrell<[email-masked]>  writes:

Fair enough. (You're the 2nd to ask)

Look at the "From" list on [1]

Cheers,
S

[1] https://datatracker.ietf.org/liaison/

>
> /Simon
> _______________________________________________
> saag mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/saag
>

---

From: Brian Weis <[email-masked]>
Date: Thu, 12 Apr 2012 12:14:12 -0700

As an aside for those who aren't aware, IEEE 802 (and some other IEEE standards) are available free of charge  <http://standards.ieee.org/about/get/> six months after they issue.

Brian

-- 
Brian Weis
Security Standards and Technology, SRTG, Cisco Systems
Telephone: +1 408 526 4796
Email: [email-masked]

---

From: Mouse <[email-masked]>
Date: Thu, 12 Apr 2012 15:46:23 -0400 (EDT)

> As an aside for those who aren't aware, IEEE 802 (and some other IEEE
> standards) are available free of charge
> <http://standards.ieee.org/about/get/> six months after they issue.

Even if it's an "aside", I think it's fair to point out here that
IEEE's terms are substantially more restrictive than "an open URL that
anyone can read".  For example, I'm not allowed to put them anywhere my
usual backup regimen applies, because that involes a backup copy on-net
and a second backup copy offsite.  They also are licensed only for
personal use (whatever that means; the terms-of-use do not explain).
I'm not even sure whether I'd be allowed to convert it to plain text
(which is normally the first thing I do with PDFs; plain text is far
more useful for most of my purposes for most PDFs).

Also, their development process _is_ closed, meaning that the results
will be heavily biased towards benefits for their membership rather
than benefits for the world at large, for the Internet, or for the
state of the art.

So I'm with Michael on this one.  The IEEE is slightly better than some
other (fully pay-to-play) `standards' organizations, but it's got a
long way to go before I would consider it acceptable for IETF purposes,
and before I would consider reviewing their documents without pay.

/~\ The ASCII				  Mouse
\ / Ribbon Campaign
 X  Against HTML		[email-masked]
/ \ Email!	     7D C8 61 52 5D E7 2D 39  4E F1 31 3E E8 B3 27 4B