Subject: Re: [oauth] OAuth Security Advisory

From: Leif Johansson <[email-masked]>
Date: Fri, 1 May 2009 17:27:34 +0200

On Thursday 30 April 2009 00:03:42 Eran Hammer-Lahav wrote:
> This list (IETF) has no "jurisdiction" over the Core 1.0 version which is
> being addressed on the OAuth public list. Once a solution is proposed, it
> will be reflected in the draft-hammer-oauth I-D and will be part of the WG
> discussions.
>
> I did notify the security area but since I am not on their list, not sure
> if they discussed it or not.
>
> EHL

Eran,

Getting input from the IETF requires trust from the IETF. Getting the IETF
to trust you probably means you have a somewhat less formal approach to
what information goes where. Involving everyone in what is percieved to 
be a serious protocol flaw would have cost you next to nothing ... 

	Cheers Leif

---

From: Blaine Cook <[email-masked]>
Date: Fri, 1 May 2009 17:08:52 +0100

> be a serious protocol flaw would have cost you next to nothing ...

My understanding is that Eran's done the correct thing here -- since
the OAuth is not yet chartered at the IETF, and the specifications in
question are actually different documents, my impression was that it
wasn't kosher to start a parallel discussion on this list until after
the charter is approved.

Rest assured that there's no "formal" approach to providing
information. Eran struggled at length to ensure that everyone with a
stake in OAuth received the information in a timely fashion, and was
in fact commended on his efforts by several tech news outlets.

I for one greatly value the IETF's input, and encourage any concerns /
comments regarding the immediate situation to be posted here (if
that's acceptable given the non-chartered status), on the non-IETF
OAuth list ([email-masked]), or privately to myself or Eran as
above.

b.

---

From: Eran Hammer-Lahav <[email-masked]>
Date: Fri, 1 May 2009 09:27:24 -0700

I must admit that I don't fully understand what you wrote.

We found a threat and the community who wrote the spec is working on a fix. We chose a venue for this discussion based on where the most active and relevant community resides. I am not interested in having a fractured conversation over multiple lists. That is not "cost next to nothing". I have notified different areas of the IETF about this because of the upcoming work and invited people to join the discussion.

I have no clue what your point is about the IETF, trust, and format approaches.

Also keep in mind that there must not be an automatic assumption that everyone involved or using OAuth Core 1.0 is going to transition or join the IETF effort. While I certainly intend to and hope others will do the same, there is an active community working on this and it has its own way of dealing with issues that relate to their work. The same is true for the IETF, and I expect the RFC version of OAuth to handle such cases differently in terms of where the discussion will be held.

EHL

> -----Original Message-----
> From: Leif Johansson [mailto:[email-masked]]
> Sent: Friday, May 01, 2009 8:28 AM
> To: [email-masked]
> Cc: Eran Hammer-Lahav; J. Trent Adams
> Subject: Re: [oauth] OAuth Security Advisory
> 
> > This list (IETF) has no "jurisdiction" over the Core 1.0 version
> which
> > is being addressed on the OAuth public list. Once a solution is
> > proposed, it will be reflected in the draft-hammer-oauth I-D and will
> > be part of the WG discussions.
> >
> > I did notify the security area but since I am not on their list, not
> > sure if they discussed it or not.
> >
> > EHL
> 
> Eran,
> 
> Getting input from the IETF requires trust from the IETF. Getting the
> IETF to trust you probably means you have a somewhat less formal
> approach to what information goes where. Involving everyone in what is
> percieved to be a serious protocol flaw would have cost you next to
> nothing ...
> 
> 	Cheers Leif

---

From: Leif Johansson <[email-masked]>
Date: Sun, 3 May 2009 10:34:18 +0200

On Friday 01 May 2009 18:27:24 Eran Hammer-Lahav wrote:
> We found a threat and the community who wrote the spec is working on a fix.
> We chose a venue for this discussion based on where the most active and
> relevant community resides. I am not interested in having a fractured
> conversation over multiple lists. That is not "cost next to nothing". I
> have notified different areas of the IETF about this because of the
> upcoming work and invited people to join the discussion.
>
> Also keep in mind that there must not be an automatic assumption that
> everyone involved or using OAuth Core 1.0 is going to transition or join
> the IETF effort. While I certainly intend to and hope others will do the
> same, there is an active community working on this and it has its own way
> of dealing with issues that relate to their work. The same is true for the
> IETF, and I expect the RFC version of OAuth to handle such cases
> differently in terms of where the discussion will be held.

I think you read too much into what I wrote. I simply meant that a short 
note to the IETF list noting that a protocol problem had been discovered 
and that work was in progress and where dicussions was taking place 
would have helped people on this list know where to go and what was
being done. 

	Cheers Leif