Subject: Re: [Txauth] WG name: TxAuth? XAuth? Something else?

From: Mike Jones <[email-masked]>
Date: Tue, 17 Mar 2020 16:24:16 +0000

If this work were happening in the OAuth working group, calling it OAuth 3 would be a decision that could be taken by the working group.  But unless it moves to the OAuth working group, I believe that it would be unreasonable to usurp branding belonging to a different working group.  TxAuth should have its own distinct brand chosen by its to-be-formed working group.

                                                       -- Mike

From: Txauth <[email-masked]> On Behalf Of Justin Richer
Sent: Tuesday, March 17, 2020 6:11 AM
To: Dick Hardt <[email-masked]>
Cc: Yaron Sheffer <[email-masked]>; [email-masked]
Subject: Re: [Txauth] WG name: TxAuth? XAuth? Something else?

And another thought — there’s a pretty decent chance that we’ll end up branding this whole effort OAuth 3 in the future.

The list is named ‘txauth’. Therefore, calling what we’re working on anything different from that seems silly and premature.

I say we just stick with TxAuth to match the list and avoid the whole naming discussion entirely.

 — Justin

On Mar 16, 2020, at 9:56 PM, Justin Richer <[email-masked]<mailto:[email-masked]>> wrote:

Yes, naming things is hard — but I still believe in the name TxAuth. We’re moving beyond OAuth, and taking the process of getting an authorization delegated to the client software as a multi-step, multi-party transaction is, I believe, the key insight that’s letting us move beyond OAuth’s limitations here. It’s not just about going to the AS first — we had that in OAuth 1 and we’re patching that into OAuth 2 with PAR. I really think it’s about the transaction at the core.

Having come of age in the 1990’s, I have particular dislike for XAuth. It sounds too “X-TREME” and “X-CITING”, and if you read either of those with a growling yell in your head then you know exactly what I’m talking about. And to Dick’s rationale for the name below, I absolutely do NOT see this work as “OAuth with all the extra features”. I think that does a disservice to the kind of change we have an opportunity to make here.

 — Justin

On Mar 16, 2020, at 7:04 PM, Dick Hardt <[email-masked]<mailto:[email-masked]>> wrote:

Hello everyone

I prompted a thread around the name of the protocol a while back:

https://mailarchive.ietf.org/arch/msg/txauth/ZVQVbHt4ADqehKrBDXOrTr_s_wc/

As Justin stated "naming is hard"

Wearing my marketing hat I want to ensure that the name will be perceived properly in the broader community.

A recent example that comes to mind are the privacy related works on the browser storage API. Given that name, one would think that it is local storage. It is actually about browser cookies.

Justin discussed his reasons for TxAuth in the thread above (and I'm sure in other places)

I chose XAuth in my draft to reflect the eXtensibility goal that we have over OAuth -- and XAuth is OAuth but with an X to reflect all the extra features. =)

Other suggestions?

This will be an agenda item in the BoF -- but the name will NOT be an open discussion item -- we will summarize what has been discussed on the list and perhaps do a poll of options presented unless consensus is obvious from this thread.

/Dick

[https://mailfoogae.appspot.com/t?sender=aZGljay5oYXJkdEBnbWFpbC5jb20=&type=zerocontent&guid=b21a2a6d-d7e3-45fa-b7a8-84768a1bd2ea]ᐧ

--
Txauth mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/txauth

---

From: Justin Richer <[email-masked]>
Date: Tue, 17 Mar 2020 17:13:23 -0400

Mike,

Yes, I agree, and we decided some time back on this list to not push calling it OAuth 3. That is not what I’m saying to do and not what we are discussing. I still think that this is a potential outcome through coordination with the OAuth working group some day in the future, but that’s not for us to decide now and it’s not for us to decide alone. 

This is exactly why I’m arguing that we should use the branding of “TxAuth” for this work right now. 

The AD’s and I went back and forth with a bunch of different names for this list, and I still think we came up with a decent one here, and we should stick with that. I had originally proposed that we call the list itself “xyz”, but realized after some discussion that it would have been pretentious and presumptuous to try to name a potentially future working group after my own existing solution. 

So again I say we just call it TxAuth and not get distracted by the naming discussion. If you search for “txauth” on the web, nearly everything you find points back to this group and this work. We’ve already got a solid brand under this term, it fits pretty well, and we should run with it for now.

 — Justin

> On Mar 17, 2020, at 12:24 PM, Mike Jones <[email-masked]> wrote:
> 
> From: Txauth <[email-masked] <mailto:[email-masked]>> On Behalf Of Justin Richer
> To: Dick Hardt <[email-masked] <mailto:[email-masked]>>
> Cc: Yaron Sheffer <[email-masked] <mailto:[email-masked]>>; [email-masked] <mailto:[email-masked]>
> On Mar 16, 2020, at 9:56 PM, Justin Richer <[email-masked] <mailto:[email-masked]>> wrote:
>  
> On Mar 16, 2020, at 7:04 PM, Dick Hardt <[email-masked] <mailto:[email-masked]>> wrote:
>  
> Hello everyone
>  
> https://mailarchive.ietf.org/arch/msg/txauth/ZVQVbHt4ADqehKrBDXOrTr_s_wc/ <https://mailarchive.ietf.org/arch/msg/txauth/ZVQVbHt4ADqehKrBDXOrTr_s_wc/>
>  
> ᐧ
> [email-masked] <mailto:[email-masked]>
> https://www.ietf.org/mailman/listinfo/txauth <https://www.ietf.org/mailman/listinfo/txauth>

---

From: Dick Hardt <[email-masked]>
Date: Fri, 20 Mar 2020 12:36:53 -0700

I agree with Mike, particularly as per the charter it covers both OAuth and
OpenID Connect use cases per the charter:

It will expand upon the uses cases currently supported by OAuth 2.0 and
OpenID Connect (itself an extension of OAuth 2.0)

On Tue, Mar 17, 2020 at 9:24 AM Mike Jones <[email-masked]>
wrote:

> If this work were happening in the OAuth working group, calling it OAuth 3
> would be a decision that could be taken by the working group.  But unless
> it moves to the OAuth working group, I believe that it would be
> unreasonable to usurp branding belonging to a different working group.
> TxAuth should have its own distinct brand chosen by its to-be-formed
> working group.
>
>
>
>                                                        -- Mike
>
>
>
> *From:* Txauth <[email-masked]> *On Behalf Of *Justin Richer
> *Sent:* Tuesday, March 17, 2020 6:11 AM
> *To:* Dick Hardt <[email-masked]>
> *Cc:* Yaron Sheffer <[email-masked]>; [email-masked]
> *Subject:* Re: [Txauth] WG name: TxAuth? XAuth? Something else?
>
>
>
> And another thought — there’s a pretty decent chance that we’ll end up
> branding this whole effort OAuth 3 in the future.
>
>
>
> The list is named ‘txauth’. Therefore, calling what we’re working on
> anything different from that seems silly and premature.
>
>
>
> On Mar 16, 2020, at 9:56 PM, Justin Richer <[email-masked]> wrote:
>
>
>
> Yes, naming things is hard — but I still believe in the name TxAuth. We’re
> moving beyond OAuth, and taking the process of getting an authorization
> delegated to the client software as a multi-step, multi-party transaction
> is, I believe, the key insight that’s letting us move beyond OAuth’s
> limitations here. It’s not just about going to the AS first — we had that
> in OAuth 1 and we’re patching that into OAuth 2 with PAR. I really think
> it’s about the transaction at the core.
>
>
>
> Having come of age in the 1990’s, I have particular dislike for XAuth. It
> sounds too “X-TREME” and “X-CITING”, and if you read either of those with a
> growling yell in your head then you know exactly what I’m talking about.
> And to Dick’s rationale for the name below, I absolutely do NOT see this
> work as “OAuth with all the extra features”. I think that does a disservice
> to the kind of change we have an opportunity to make here.
>
>
>
>  — Justin
>
>
>
> On Mar 16, 2020, at 7:04 PM, Dick Hardt <[email-masked]> wrote:
>
>
>
> Hello everyone
>
>
>
> Wearing my marketing hat I want to ensure that the name will be
> perceived properly in the broader community.
>
>
>
> A recent example that comes to mind are the privacy related works on the
> browser storage API. Given that name, one would think that it is local
> storage. It is actually about browser cookies.
>
>
>
> I chose XAuth in my draft to reflect the eXtensibility goal that we have
> over OAuth -- and XAuth is OAuth but with an X to reflect all the extra
> features. =)
>
>
>
> Other suggestions?
>
>
>
> This will be an agenda item in the BoF -- but the name will NOT be an open
> discussion item -- we will summarize what has been discussed on the list
> and perhaps do a poll of options presented unless consensus is obvious from
> this thread.
>
>
>
> /Dick
>
>
>
>
>
>
>
>
>
>
>
> ᐧ
>
>
>
> --
> Txauth mailing list
> [email-masked]

---

From: Dick Hardt <[email-masked]>
Date: Fri, 20 Mar 2020 12:41:11 -0700

I forgot to share an anecdote about name confusion:

I'm lurking in the W3C privacy community group virtual meetings, which are
dominated by browser vendors. There was discussion about access control for
the Storage API. It took me a while before I realized the Storage API is
how a browser accesses cookies, and is NOT how a browser access local
storage.

On Fri, Mar 20, 2020 at 12:36 PM Dick Hardt <[email-masked]> wrote:

> I agree with Mike, particularly as per the charter it covers both OAuth
> and OpenID Connect use cases per the charter:
>
>> If this work were happening in the OAuth working group, calling it OAuth
>> 3 would be a decision that could be taken by the working group.  But unless
>> Yes, naming things is hard — but I still believe in the name TxAuth.
>> We’re moving beyond OAuth, and taking the process of getting an
>> authorization delegated to the client software as a multi-step, multi-party
>> transaction is, I believe, the key insight that’s letting us move beyond
>> OAuth’s limitations here. It’s not just about going to the AS first — we
>> had that in OAuth 1 and we’re patching that into OAuth 2 with PAR. I really
>> think it’s about the transaction at the core.
>>
>>
>>
>> This will be an agenda item in the BoF -- but the name will NOT be an
>> open discussion item -- we will summarize what has been discussed on the
>> list and perhaps do a poll of options presented unless consensus is obvious
>> from this thread.
>>
>>
>>
>> /Dick
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>> ᐧ
>>
>>
>>
>> --
>> Txauth mailing list
>> [email-masked]