Subject: [openpgp] A new openpgp WG

From: Stephen Farrell <[email-masked]>
Date: Fri, 13 Mar 2015 14:26:55 +0000

Hiya,

I've just now subscribed here because Derek sent a pointer
to the recent discussion about chartering a new WG.

FWIW, as one of the security area directors who might be
involved in the chartering stuff, I'm happy to help out as
I can, and I'm sure the same goes for Kathleen. But you seem
to be doing all the right things already (discuss charter,
focus on changes people would likely implement/deploy,
meet in bar:-), which is great.

A couple of other things to do might be to send a pointer
to the general security area list ([email-masked]) asking
interested folks to subscribe here, (e.g. I think I used be
subscribed to the imc hosted list way back but I wasn't on
this one) and if the bar-BoF goes ahead, it'd be good for
one of you to grab the mic at the saag session in Dallas
and report back on that.

Please also note that there's no absolute need to have a
BoF session (e.g. in Prague in July) before a WG is formed.
If a whole bunch of people know that they all want to do a
well-scoped useful thing then we may not need one. (The
just-formed tokbind WG didn't have a BoF for example.) If
OTOH, there's a need for face-to-face discussion about
tricky scoping issues or about whether some work should be
done at all then a BoF can be a fine thing. In this case,
I'd not be surprised if no BoF were needed, in which case
we could possibly form a WG before July and get going that
much sooner. That said, please keep your focus on the
getting the right proposed charter text and don't
over-prioritise speed. (Since a lot of people still
assume a BoF session and the associated delay are mandatory,
I figured it worth pointing out that's not always the
case.)

Cheers,
S.

---

From: "Derek Atkins" <[email-masked]>
Date: Fri, 13 Mar 2015 10:40:03 -0400

Thanks, Stephen,

I'm happy to report on the Bar BOF in SAAG, assuming it happens before then.

I have not heard any response yet to my proposed Monday-after-the-Plenary
time for the Bar BOF.

I'll go send mail to SAAG right now.

Thanks!

-derek

On Fri, March 13, 2015 10:26 am, Stephen Farrell wrote:
> _______________________________________________
> openpgp mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/openpgp
>

-- 
       Derek Atkins                 617-623-3745
       [email-masked]             www.ihtfp.com
       Computer and Internet Security Consultant

---

From: Christoph Anton Mitterer <[email-masked]>
Date: Fri, 13 Mar 2015 23:46:02 +0100

On Fri, 2015-03-13 at 14:26 +0000, Stephen Farrell wrote: 
> interested folks to subscribe here
I think the same should be done for other well known crypto lists like
[email-masked] or the CFRG,...

Cheers,
Chris.

---

From: David Leon Gil <[email-masked]>
Date: Fri, 13 Mar 2015 16:36:39 -0700

It is unlikely I would be able to attend the March IETF with such
short notice. (I also have other travel plans in this timeframe.)

Therefore, Yahoo would request that the IETF defer action. (July sounds fine.)

Both Yahoo and Google are presently planning deployment of a browser
extension using OpenPGP. (Google's open-source branch is at
https://github.com/google/end-to-end; our branch will be open-sourced
soon at https://github.com/yahoo/end-to-end.)

We would expect this to be one of the larger deployments of OpenPGP,
and to face unique constraints (because of its implementation in
JavaScript, and deployment via the Web Platform).

I am hopeful that feedback on the open-source extensions will prove
useful in whatever standards process may emerge.

David Leon Gil
Senior Paranoid
Yahoo!

PS. This is a statement of Yahoo's position.

This message is sent from a Gmail account because Yahoo sets a strict
DMARC policy, which may result in some recipients MTAs (e.g. Google's)
dropping a message.

See http://dmarc.org/faq.html#s_3 for things mailing lists can do to
avoid this. There are also things webmail providers can do to mitigate
this problem, but Google won't do them.

The benefits to DKIM are tremendous, w.r.t. protection of users from
phishing or other malicious emails. I strongly encourage mailing list
owners and webmail providers to take steps to ensure that all users'
messages are correctly handled with a DKIM p=reject.

---

From: Stephen Farrell <[email-masked]>
Date: Sat, 14 Mar 2015 13:47:28 +0000

Hi David,

> Therefore, Yahoo would request that the IETF defer action. (July sounds fine.)

I don't think you need worry - interested folks will hopefully
manage to meet in Dallas, but any action will really happen here
on the mailing list. So we're not deferring action, we're aiming
to behave as usual, and work primarily via this list, with face
to face meetings being used for higher bandwidth interactions
etc.

I'd also note that saying "Yahoo would request" and other uses
of a company name like that tend to grate (as in "sound bad")
in an IETF context.

There are a bunch of good reasons why we recognise you David as
a participant who can argue technical details and why we do not
similarly recognise companies or other organisations. (And that's
not something to discuss here, but I'm happy to follow up off
list to explain more, as it is a different culture from most
other organisations.) So that kind of appeal to authority is
much better avoided in general, and also on this list.

> JavaScript, and deployment via the Web Platform).

Good stuff. I would really hope that one of the outcomes of
whatever we end up doing is providing interoperability with the
best security properties we can between the likely deployment of
that fine bit of work and others on the Internet using the
OpenPGP protocol. I really hope we all share that goal.

Cheers,
S.