Subject: [websec] draft-ietf-websec-mime-sniff

From: Pete Resnick <[email-masked]>
Date: Mon, 25 Jul 2011 14:29:28 -0400

[Same preface I gave when I spoke at the mic in the WG session: I am 
speaking as an individual IETF participant, not as an AD. This comment 
by itself will not cause me to DISCUSS the document when it comes to the 
IESG. If the consensus of the WG is that I am wrong about this, I may 
validly end up in the "rough" part of the "rough consensus". However, 
this is a comment that needs to be addressed.]

I think this document is real problem and I object to the current form 
it is in. Having an algorithm without explanation as to *why* one ought 
to perform the steps in the algorithm is completely inappropriate and 
not worthy of WG publication. We do not do blind instructions without 
explanation in the IETF. It also makes it nearly impossible for the IETF 
community to review the document to see if the instructions given are 
sane or not. I think the document either needs to be completely 
rewritten or needs to be withdrawn.

pr

-- 
Pete Resnick<http://www.qualcomm.com/~presnick/>
Qualcomm Incorporated - Direct phone: (858)651-4478, Fax: (858)651-1102

---

From: Adam Barth <[email-masked]>
Date: Thu, 28 Jul 2011 16:45:25 -0700

Hi Pete,

On Mon, Jul 25, 2011 at 11:29 AM, Pete Resnick <[email-masked]> wrote:
> I think this document is real problem and I object to the current form it is
> in. Having an algorithm without explanation as to *why* one ought to perform
> the steps in the algorithm is completely inappropriate and not worthy of WG
> publication. We do not do blind instructions without explanation in the
> IETF. It also makes it nearly impossible for the IETF community to review
> the document to see if the instructions given are sane or not. I think the
> document either needs to be completely rewritten or needs to be withdrawn.

I appreciate your being straightforward on this topic.  I certainly
understand your point of view, and I don't have a particular desire to
twist your (or the large IETF community's) arm in this matter.  Rather
than fight over this topic, I think it would be better for me to
withdraw the document.

Thanks,
Adam

---

From: Mark Nottingham <[email-masked]>
Date: Thu, 28 Jul 2011 16:52:07 -0700

> than fight over this topic, I think it would be better for me to

That's a bit of an extreme reaction.

You could annotate the document with a commentary of why particular decisions were taken. You could add an appendix.

You could even get someone else to do this if you don't have time or interest.

I'd rather see this document published -- even if flawed or incomplete -- than not published. It represents a big step forward from the current situation. Pete's just asking for how you got to where you are.

Cheers,

--
Mark Nottingham   http://www.mnot.net/

---

From: Adam Barth <[email-masked]>
Date: Thu, 28 Jul 2011 16:58:41 -0700

> I'd rather see this document published -- even if flawed or incomplete -- than not published. It represents a big step forward from the current situation. Pete's just asking for how you got to wher…

Pete seemed pretty clear.  He asked me to either rewrite the document
completely or withdraw it.  Rather than fighting about this document,
I'd rather move forward with documents the working group and the IETF
are excited about publishing.

Adam

---

From: Bjoern Hoehrmann <[email-masked]>
Date: Fri, 29 Jul 2011 02:25:35 +0200

>rewritten or needs to be withdrawn.

My experience is that people who are given instructions, but no means to
understand why the instructions are given, tend to implement them wrong.
My experience is also that people who give instructions, but do not ex-
plain why they are giving them, often do not really understand why they
provide the instructions either, which often means the instructions they
are giving are actually wrong, in one sense or another.

You can largely eliminate both problems by having a test suite that can
easily be automated: if people use the test suite, they'll find cases
where the wrong instructions are given, and they can find cases where
the instructions have been misunderstood or incorrectly implemented. So,
if there is a very good test suite, I could live with a specification
that does not explain rationale behind requirements quite well.

(A test suite does not replace rationale, as a test suite would capture
only the status quo, which may change at any time; how it may change is
dependant on rationale, so even with the most excellent test suite, a
specification without rationale is strictly worse than one with as you
could not predict changes based, only, on what you know from both.)
-- 
Björn Höhrmann · mailto:[email-masked] · http://bjoern.hoehrmann.de
Am Badedeich 7 · Telefon: +49(0)160/4415681 · http://www.bjoernsworld.de
25899 Dagebüll · PGP Pub. KeyID: 0xA4357E78 · http://www.websitedev.de/

---

From: "Martin J. Dürst" <[email-masked]>
Date: Sun, 31 Jul 2011 18:38:10 +0900

On 2011/07/29 8:58, Adam Barth wrote:
> On Thu, Jul 28, 2011 at 4:52 PM, Mark Nottingham<[email-masked]>  wrote:
>>> On Mon, Jul 25, 2011 at 11:29 AM, Pete Resnick<[email-masked]>  wrote:
> Pete seemed pretty clear.

Yes indeed. That's his style. To me, it seems close to your style :-).

> He asked me to either rewrite the document
> completely or withdraw it.

He explicitly wrote that this was his personal opinion. The fact that he 
said he won't raise a DISCUSS means that he will respect WG consensus.

> Rather than fighting about this document,

Well, come on. There are lots of documents in the IETF that nobody is 
really excited about. Think about all the NAT-related stuff to start with.

And I hope you will admit to yourself that there's tons of stuff within 
and outside of the IETF that's way more exciting than MIME sniffing. As 
you probably understand better than others, it nevertheless seems to be 
necessary.

Regards,   Martin.