Subject: [OAUTH-WG] Security area review

From: Eran Hammer-Lahav <[email-masked]>
Date: Sat, 6 Aug 2011 00:29:14 -0700

Did the chairs issue a last call request to anyone in the security area? I thought the whole point of moving this working group from apps to security was to increase the review and participation of that area. So far I have seen absolutely nothing to indicate any such contribution. I would like to know what actual actions are being taken to turn this promise into reality.

EHL

---

From: Barry Leiba <[email-masked]>
Date: Sun, 7 Aug 2011 23:28:30 -0400

> Did the chairs issue a last call request to anyone in the security area? I
> thought the whole point of moving this working group from apps to security
> was to increase the review and participation of that area. So far I have
> seen absolutely nothing to indicate any such contribution. I would like to
> know what actual actions are being taken to turn this promise into reality.

There'll be a security directorate review when we send the doc to the
IESG.  I can certainly ask Sam to schedule a review now, instead of
waiting, and I'll do that.

Barry, as chair

---

From: Eran Hammer-Lahav <[email-masked]>
Date: Sun, 7 Aug 2011 22:59:41 -0700

Thanks.

But this still puzzles me. After two years in the application area where IMO this working clearly belongs, we were moved to the security area under the premise of increased review and engagement from the security area.

EHL

> -----Original Message-----
> From: [email-masked]
> [mailto:[email-masked]] On Behalf Of Barry Leiba
> Sent: Sunday, August 07, 2011 8:29 PM
> To: Eran Hammer-Lahav
> Cc: OAuth WG
> Subject: Re: [OAUTH-WG] Security area review
> 
> > Did the chairs issue a last call request to anyone in the security
> > area? I thought the whole point of moving this working group from apps
> > to security was to increase the review and participation of that area.
> > So far I have seen absolutely nothing to indicate any such
> > contribution. I would like to know what actual actions are being taken to
> turn this promise into reality.
> 
> There'll be a security directorate review when we send the doc to the IESG.  I
> can certainly ask Sam to schedule a review now, instead of waiting, and I'll do
> that.
> 
> Barry, as chair

---

From: "Richard L. Barnes" <[email-masked]>
Date: Mon, 8 Aug 2011 08:24:49 -0400

<hat type="secdir"/>

I've been loosely following this group, probably not as closely as I should have.  I'll put it in my queue to do a review of the current doc as a way of getting back in the fray.

--Richard

On Aug 8, 2011, at 1:59 AM, Eran Hammer-Lahav wrote:

> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth

---

From: Barry Leiba <[email-masked]>
Date: Mon, 8 Aug 2011 09:15:05 -0400

> But this still puzzles me. After two years in the application area where IMO this
> working clearly belongs, we were moved to the security area under the premise
> of increased review and engagement from the security area.

I can't speak for the IESG, and it's they who made the decision to
move the WG.  But I can say that I disagree that it "clearly belongs"
in the App area.  From the start, I was puzzled why it wasn't
chartered in the Sec area; OAuth is, to me, a security protocol that's
used at the app layer (as opposed to an app protocol that happens to
include security).  DKIM was in a similar situation -- having bits in
both areas -- and in 2006 was chartered in Sec... and that one seemed
even more that it should have been in Apps.

We have puzzling situations often, these days, where working groups
"clearly belong" in more than one area, and the way things currently
work, the IESG has to choose.  ALTO might have been in RAI or App, was
chartered in App, and now is in TSV.  We've had a few recently
chartered WGs where there was some debate about which area they belong
in.  I've thought for some time that we should have multi-area WGs,
but that's not the case now.

Don't pay too much attention to which AD manages the WG.

Barry

---

From: Hannes Tschofenig <[email-masked]>
Date: Mon, 29 Aug 2011 11:15:51 +0300

Hi Eran, 

I gave presentations to the security area directorate, and have asked for review comments. Some of the folks (such as Tom Yu, and Shawn Emery) showed up in the meetings and the side meetings and provided comments. 
As Barry said, there will be more review comments flying in after the document left the working group. 

Ciao
Hannes

PS: I had also given presentations at the SAAG meeting to solicit more feedback.