Subject: [Ghost] This could be really useful

From: "Boyle, Vincent M" <[email-masked]>
Date: Thu, 30 Jul 2015 18:35:38 +0000

Hi Everybody,
I saw the announcement and subscribed. I like the idea of an organized repository for practical information on standards. While the focus of the Google doc is on developers, I'd like to offer another perspective, that of the user. I participate in an effort to select standards for a large, enterprise network (the US DoD). The goal is to promote interoperability across the network by enforcing the use of selected standards by all major programs that use that network. Specifically, I'm a member of the Information Assurance (i.e. security) working group of the effort. Three times a year we meet to review portions of the standards registry and vote on retaining those standards or replacing them with newer ones. 

The information that is being proposed for inclusion in the ghost repository is exactly the information that we research and discuss prior to voting. We want to choose standards that offer state of the art security, but they need to be implementable (and actually implemented in products). In that vein, I was happy to see that there would be information on which standards seem to be on the upswing. If we can  document actual implementation in some way that is fair and accurate (not easily gamed by people with proprietary interests), that would be great!

I'll chime in later; just wanted to put in a nudge to the user community to support this.

Mike Boyle

---

From: Tom Ritter <[email-masked]>
Date: Fri, 31 Jul 2015 23:10:11 -0500

On Jul 30, 2015 1:35 PM, "Boyle, Vincent M" <[email-masked]> wrote:
> If we can  document actual implementation in some way that is fair and
> accurate (not easily gamed by people with proprietary interests), that
> would be great!

Test suites would go a long way towards documenting implementation
status, and promoting interoperable bug-free implementations. I dream
of a day where we have a full, open source test suite for (say) TLS
that operates at the TCP layer. It attempts to talk various flavors of
correct and incorrect TLS with a client or server, and makes sure the
other responds when it should and doesn't when it shouldn't.

We can hope vendors will use it... but the next step is actually to
push it towards the organizations doing the purchasing.  "Let me run
this test suite against your product.  Turns out it has a bug with CBC
Padding, chokes on extensions it doesn't understand, and is intolerant
if you try to negotiate a higher, unknown protocol version.  Go fix
those bugs, show me the patch, and I'll buy."

-tom