Subject: [Txauth] WG name: TxAuth? XAuth? Something else?

From: Dick Hardt <[email-masked]>
Date: Mon, 16 Mar 2020 16:04:27 -0700

Hello everyone

I prompted a thread around the name of the protocol a while back:

https://mailarchive.ietf.org/arch/msg/txauth/ZVQVbHt4ADqehKrBDXOrTr_s_wc/

As Justin stated "naming is hard"

Wearing my marketing hat I want to ensure that the name will be
perceived properly in the broader community.

A recent example that comes to mind are the privacy related works on the
browser storage API. Given that name, one would think that it is local
storage. It is actually about browser cookies.

Justin discussed his reasons for TxAuth in the thread above (and I'm sure
in other places)

I chose XAuth in my draft to reflect the eXtensibility goal that we have
over OAuth -- and XAuth is OAuth but with an X to reflect all the extra
features. =)

Other suggestions?

This will be an agenda item in the BoF -- but the name will NOT be an open
discussion item -- we will summarize what has been discussed on the list
and perhaps do a poll of options presented unless consensus is obvious from
this thread.

/Dick

ᐧ

---

From: Justin Richer <[email-masked]>
Date: Mon, 16 Mar 2020 21:56:51 -0400

Yes, naming things is hard — but I still believe in the name TxAuth. We’re moving beyond OAuth, and taking the process of getting an authorization delegated to the client software as a multi-step, multi-party transaction is, I believe, the key insight that’s letting us move beyond OAuth’s limitations here. It’s not just about going to the AS first — we had that in OAuth 1 and we’re patching that into OAuth 2 with PAR. I really think it’s about the transaction at the core. 

Having come of age in the 1990’s, I have particular dislike for XAuth. It sounds too “X-TREME” and “X-CITING”, and if you read either of those with a growling yell in your head then you know exactly what I’m talking about. And to Dick’s rationale for the name below, I absolutely do NOT see this work as “OAuth with all the extra features”. I think that does a disservice to the kind of change we have an opportunity to make here. 

 — Justin

> On Mar 16, 2020, at 7:04 PM, Dick Hardt <[email-masked]> wrote:
> 
> Hello everyone
> 
> https://mailarchive.ietf.org/arch/msg/txauth/ZVQVbHt4ADqehKrBDXOrTr_s_wc/ <https://mailarchive.ietf.org/arch/msg/txauth/ZVQVbHt4ADqehKrBDXOrTr_s_wc/>
> 
> Wearing my marketing hat I want to ensure that the name will be perceived properly in the broader community.
> 
> A recent example that comes to mind are the privacy related works on the browser storage API. Given that name, one would think that it is local storage. It is actually about browser cookies.
> 
> Justin discussed his reasons for TxAuth in the thread above (and I'm sure in other places)
> 
> I chose XAuth in my draft to reflect the eXtensibility goal that we have over OAuth -- and XAuth is OAuth but with an X to reflect all the extra features. =)
> 
> Other suggestions?
> 
> This will be an agenda item in the BoF -- but the name will NOT be an open discussion item -- we will summarize what has been discussed on the list and perhaps do a poll of options presented unless consensus is obvious from this thread.
> 
> /Dick
> 
> 
> 
> 
> 
> ᐧ

---

From: Justin Richer <[email-masked]>
Date: Tue, 17 Mar 2020 09:10:30 -0400

And another thought — there’s a pretty decent chance that we’ll end up branding this whole effort OAuth 3 in the future. 

The list is named ‘txauth’. Therefore, calling what we’re working on anything different from that seems silly and premature.

I say we just stick with TxAuth to match the list and avoid the whole naming discussion entirely.

 — Justin

> On Mar 16, 2020, at 9:56 PM, Justin Richer <[email-masked]> wrote:
> 
>> On Mar 16, 2020, at 7:04 PM, Dick Hardt <[email-masked] <mailto:[email-masked]>> wrote:
>> 
>> Hello everyone
>> 
> -- 
> Txauth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/txauth

---

From: Dick Hardt <[email-masked]>
Date: Fri, 20 Mar 2020 12:31:30 -0700

Roman / Ben

Is there a reason we can't change the name of the list, or create a new
list when the WG is formed?

On Tue, Mar 17, 2020 at 6:10 AM Justin Richer <[email-masked]> wrote:

> And another thought — there’s a pretty decent chance that we’ll end up
> branding this whole effort OAuth 3 in the future.
>
> The list is named ‘txauth’. Therefore, calling what we’re working on
> anything different from that seems silly and premature.
>
> Yes, naming things is hard — but I still believe in the name TxAuth. We’re
> moving beyond OAuth, and taking the process of getting an authorization
> delegated to the client software as a multi-step, multi-party transaction
> is, I believe, the key insight that’s letting us move beyond OAuth’s
> limitations here. It’s not just about going to the AS first — we had that
> in OAuth 1 and we’re patching that into OAuth 2 with PAR. I really think
> it’s about the transaction at the core.
>
> Having come of age in the 1990’s, I have particular dislike for XAuth. It
> sounds too “X-TREME” and “X-CITING”, and if you read either of those with a
> growling yell in your head then you know exactly what I’m talking about.
> And to Dick’s rationale for the name below, I absolutely do NOT see this
> work as “OAuth with all the extra features”. I think that does a disservice
> to the kind of change we have an opportunity to make here.
>
>  — Justin
>

---

From: Dick Hardt <[email-masked]>
Date: Fri, 20 Mar 2020 12:32:19 -0700

not a transaction - there are multiple transactions

backchannel innovation is combination of here is who I am, and here is what
I want to do

childhood trauma therapy group

> it’s about the transaction at the core.

OAuth 2.0 had multi-step, multi-party. TxAuth extends that.

I think the big shift is going to the AS. This enables the request to be
richer with JSON, instead of name/value pairs parameters in a URI. It
allows the client and AS to negotiate, and to short circuit having to
redirect the user to the AS. PAR does some of this, but it is constrained
by having to do it in the OAuth 2.0 context.

My concern is that the protocol is MUCH MORE than a transaction. While the
initial interaction between client, AS, user and RO is a transaction. The
protocol also covers the client and RS interactions. The access token
refreshes. Access token revocation. Access token introspection. As
described in the charter, there is a whole lifecycle, that consists of
multiple transactions.

>From https://www.merriam-webster.com/dictionary/transaction:

Definition of *transaction*

1a: something transacted
<https://www.merriam-webster.com/dictionary/transacted>especially : an
exchange or transfer <https://www.merriam-webster.com/dictionary/transfer> of
goods, services, or fundselectronic transactions
b: transactions plural : the often published record of the meeting of a
society or association
2a: an act, process, or instance of transacting
<https://www.merriam-webster.com/dictionary/transacting>
b: a communicative action or activity involving two parties or things that
reciprocally affect or influence each other

Calling the protocol a transaction will confusing to people.

> growling yell in your head then you know exactly what I’m talking about.

In case you are confused, this is not a childhood trauma support group.  :)

Unlike "X-TREME" or "X-CITING", XAuth is using the "X" as a placeholder.
X-Men, Xbox, X-Factor, X-files.

https://www.businessinsider.com/the-indisputable-power-of-brand-x-2012-4

https://english.stackexchange.com/questions/358181/whats-the-purpose-of-using-letter-x-or-x-as-a-suffix-in-brand-names

>From the charter

"It will expand upon the uses cases currently supported by OAuth 2.0 and
OpenID Connect (itself an extension of OAuth 2.0)"

Which sounds pretty similar to “OAuth with all the extra features”

While I think XAuth captures what we are doing, a placeholder name would be
preferable to an incorrect descriptive name such as TxAuth.

For example, XYZ is a good placeholder name. Or XYZAuth. Let's not mislead
people.

---

From: Justin Richer <[email-masked]>
Date: Fri, 20 Mar 2020 20:53:55 -0400

Dick, thanks for pulling the definitions up:

> a communicative action or activity involving two parties or things that reciprocally affect or influence each other

This is the kind of thing that I had in mind. The client and the AS are in a conversation over time that each one contributes to and each changes. 

Also — we can just as easily decide that “TxAuth” doesn’t stand for “Transactional Auth” much the same way we decided that the “O” in “OAuth” doesn’t stand for “Open” anymore. 

None of the arguments below in favor of XAuth have made me like that name better. If it’s just a “placeholder” name, then why come up with something new?

 — Justin

> On Mar 20, 2020, at 3:32 PM, Dick Hardt <[email-masked]> wrote:
> 
> 
> 
> 
> backchannel innovation is combination of here is who I am, and here is what I want to do
> 
> 
> On Mon, Mar 16, 2020 at 6:56 PM Justin Richer <[email-masked] <mailto:[email-masked]>> wrote:
> I think the big shift is going to the AS. This enables the request to be richer with JSON, instead of name/value pairs parameters in a URI. It allows the client and AS to negotiate, and to short circuit having to redirect the user to the AS. PAR does some of this, but it is constrained by having to do it in the OAuth 2.0 context.
> 
> My concern is that the protocol is MUCH MORE than a transaction. While the initial interaction between client, AS, user and RO is a transaction. The protocol also covers the client and RS interactions. The access token refreshes. Access token revocation. Access token introspection. As described in the charter, there is a whole lifecycle, that consists of multiple transactions.
> 
> From https://www.merriam-webster.com/dictionary/transaction <https://www.merriam-webster.com/dictionary/transaction>:
> 
> Definition of transaction
> 1a: something transacted <https://www.merriam-webster.com/dictionary/transacted>
> especially : an exchange or transfer <https://www.merriam-webster.com/dictionary/transfer> of goods, services, or funds
> electronic transactions
> b: transactions plural : the often published record of the meeting of a society or association
> 2a: an act, process, or instance of transacting <https://www.merriam-webster.com/dictionary/transacting>
> b: a communicative action or activity involving two parties or things that reciprocally affect or influence each other
> 
> Having come of age in the 1990’s, I have particular dislike for XAuth. It sounds too “X-TREME” and “X-CITING”, and if you read either of those with a growling yell in your head then you know exactly what I’m talking about.
> 
> Unlike "X-TREME" or "X-CITING", XAuth is using the "X" as a placeholder. X-Men, Xbox, X-Factor, X-files. 
> 
> https://www.businessinsider.com/the-indisputable-power-of-brand-x-2012-4 <https://www.businessinsider.com/the-indisputable-power-of-brand-x-2012-4>
> 
> https://english.stackexchange.com/questions/358181/whats-the-purpose-of-using-letter-x-or-x-as-a-suffix-in-brand-names <https://english.stackexchange.com/questions/358181/whats-the-purpose-of-using-letter-x-or-x-as-a-suffix-in-brand-names>
> 
>  
> And to Dick’s rationale for the name below, I absolutely do NOT see this work as “OAuth with all the extra features”. I think that does a disservice to the kind of change we have an opportunity to make here. 
> 
> From the charter 
> 
> "It will expand upon the uses cases currently supported by OAuth 2.0 and OpenID Connect (itself an extension of OAuth 2.0)"
> 
> While I think XAuth captures what we are doing, a placeholder name would be preferable to an incorrect descriptive name such as TxAuth.
> 
> For example, XYZ is a good placeholder name. Or XYZAuth. Let's not mislead people.
> 
>  
> 
>  — Justin
>

---

From: Dick Hardt <[email-masked]>
Date: Fri, 20 Mar 2020 18:16:30 -0700

That would be easier if it was TAuth rather than TxAuth. "Tx" is well known
to mean transaction -- regardless of what we decide. "O" could mean
anything that starts with "O", and my experience has been few people know
the work started as OpenAuth.

I've made my argument, I'm fine going with the group consensus. I do
reserve the right in the future to say "I told you so!" =)

Does anyone else have an opinion?

On Fri, Mar 20, 2020 at 5:53 PM Justin Richer <[email-masked]> wrote:

> > a communicative action or activity involving two parties or things that
> This is the kind of thing that I had in mind. The client and the AS are in
> a conversation over time that each one contributes to and each changes.
>
> Also — we can just as easily decide that “TxAuth” doesn’t stand for
> “Transactional Auth” much the same way we decided that the “O” in “OAuth”
> doesn’t stand for “Open” anymore.
>
> None of the arguments below in favor of XAuth have made me like that name
> better. If it’s just a “placeholder” name, then why come up with something
> new?
>
>  — Justin
>
>> Yes, naming things is hard — but I still believe in the name TxAuth.
>> We’re moving beyond OAuth, and taking the process of getting an
>> authorization delegated to the client software as a multi-step, multi-party
>> transaction is, I believe, the key insight that’s letting us move beyond
>> OAuth’s limitations here. It’s not just about going to the AS first — we
>> had that in OAuth 1 and we’re patching that into OAuth 2 with PAR. I really
>> think it’s about the transaction at the core.
>>
>
> b: a communicative action or activity involving two parties or things
> that reciprocally affect or influence each other
>
> While I think XAuth captures what we are doing, a placeholder name would
> be preferable to an incorrect descriptive name such as TxAuth.
>
>> This will be an agenda item in the BoF -- but the name will NOT be an
>> open discussion item -- we will summarize what has been discussed on the
>> list and perhaps do a poll of options presented unless consensus is obvious
>> from this thread.
>>
>> /Dick
>>
>>
>>
>>
>>
>> ᐧ
>>
>>
>>
>

---

From: Yaron Sheffer <[email-masked]>
Date: Sat, 21 Mar 2020 19:07:28 +0200

Personally, I don’t mind the “Tx” but I hate the “auth”, which everybody outside of this community understands as “authentication”.

Having said that, IMHO this discussion is not the best use of our time, and I’d rather spend it on coming up with a great protocol. Regardless of what the WG is called.

Thanks,

                Yaron

From: Dick Hardt <[email-masked]>
Date: Saturday, March 21, 2020 at 03:16
To: Justin Richer <[email-masked]>
Cc: <[email-masked]>, Yaron Sheffer <[email-masked]>
Subject: Re: WG name: TxAuth? XAuth? Something else?

That would be easier if it was TAuth rather than TxAuth. "Tx" is well known to mean transaction -- regardless of what we decide. "O" could mean anything that starts with "O", and my experience has been few people know the work started as OpenAuth.

I've made my argument, I'm fine going with the group consensus. I do reserve the right in the future to say "I told you so!" =)

 — Justin

 

 

 

Definition of transaction
1a: something transactedespecially : an exchange or transfer of goods, services, or fundselectronic transactions

 

 

 

 — Justin

Hello everyone

Other suggestions?

/Dick

 

ᐧ

---

From: Dick Hardt <[email-masked]>
Date: Sat, 21 Mar 2020 10:15:01 -0700

To clarify -- you agree it is not a transaction, and we will take the word
transaction out of the WG title?

---

From: Justin Richer <[email-masked]>
Date: Sat, 21 Mar 2020 13:43:40 -0400

As you can see in the email you replied to, that is not even close to what I said. I believe it is a transaction, and therefore, I do not agree that it’s not a transaction.

But if we take “Transactional” out of the WG title, I won’t be offended. If we just call it “TxAuth” without expansion, then that’s fine.

I do not like calling it “XAuth”. The term “TAuth" was floated during naming the list, but rejected because (among other reasons) it would likely be awkwardly pronounced as “towth” or something. TxAuth reads as “Tee - ex - oth” more naturally, which was the intent. 

So how about we take a page from the OAuth working group and name it:

	TxAuth - Next Generation Web Authorization Protocol Working Group

 — Justin

> On Mar 21, 2020, at 1:15 PM, Dick Hardt <[email-masked]> wrote:
> 
> To clarify -- you agree it is not a transaction, and we will take the word transaction out of the WG title?
> 
> On Fri, Mar 20, 2020 at 5:53 PM Justin Richer <[email-masked] <mailto:[email-masked]>> wrote:
>> On Mar 20, 2020, at 3:32 PM, Dick Hardt <[email-masked] <mailto:[email-masked]>> wrote:
>> 
>> 
>> 
>>

---

From: David Skaife <[email-masked]>
Date: Sat, 21 Mar 2020 18:08:16 +0000

Just to throw in another suggestion, to address Yaron's point about some
people mistakenly thinking that "Auth" stands for authentication rather
than authorization, how about naming the working group *AuthZ*
Nice and simple, and it makes it clear what the group is focused on.

I think the name of the actual protocol that we produce is far, far more
important that the name of the working group - and the name of that
protocol doesn't need to correlate to the WG name. Also, we have much more
time before we need to decide on the name of that protocol, even if the
initial draft documents that we produce end up using a placeholder name.

On Sat, Mar 21, 2020 at 5:44 PM Justin Richer <[email-masked]> wrote:

> As you can see in the email you replied to, that is not even close to what
> I said. I believe it is a transaction, and therefore, I do not agree that
> it’s not a transaction.
>
> But if we take “Transactional” out of the WG title, I won’t be offended.
> If we just call it “TxAuth” without expansion, then that’s fine.
>
> I do not like calling it “XAuth”. The term “TAuth" was floated during
> naming the list, but rejected because (among other reasons) it would likely
> be awkwardly pronounced as “towth” or something. TxAuth reads as “Tee - ex
> - oth” more naturally, which was the intent.
>
>> > a communicative action or activity involving two parties or things
>> This is the kind of thing that I had in mind. The client and the AS are
>> in a conversation over time that each one contributes to and each changes.
>>
>> My concern is that the protocol is MUCH MORE than a transaction. While
>> the initial interaction between client, AS, user and RO is a transaction.
>> The protocol also covers the client and RS interactions. The access token
>> exchange or transfer
>> <https://www.merriam-webster.com/dictionary/transfer> of goods,
>> services, or fundselectronic transactions
>>> Having come of age in the 1990’s, I have particular dislike for XAuth.
>>> It sounds too “X-TREME” and “X-CITING”, and if you read either of those
>>> with a growling yell in your head then you know exactly what I’m talking
>>> about.
>>>
>>

---

From: Justin Richer <[email-masked]>
Date: Sat, 21 Mar 2020 14:18:48 -0400

I disagree on the working group name being super important. Nobody knows that the OAuth WG is actually named “The Web Authorization Protocol Working Group”, and nobody cares.

My proposal is that we name the protocol we work on “TxAuth” (and keep the mailing list), and that we name the working group something like “Next Generation Web Authorization Protocol” to say what we’re doing.

 -- Justin

> On Mar 21, 2020, at 2:08 PM, David Skaife <[email-masked]> wrote:
> 
> Just to throw in another suggestion, to address Yaron's point about some people mistakenly thinking that "Auth" stands for authentication rather than authorization, how about naming the working group AuthZ
> I think the name of the actual protocol that we produce is far, far more important that the name of the working group - and the name of that protocol doesn't need to correlate to the WG name. Also, we have much more time before we need to decide on the name of that protocol, even if the initial draft documents that we produce end up using a placeholder name.
> 
> On Sat, Mar 21, 2020 at 5:44 PM Justin Richer <[email-masked] <mailto:[email-masked]>> wrote:
>> On Mar 21, 2020, at 1:15 PM, Dick Hardt <[email-masked] <mailto:[email-masked]>> wrote:
>> 
> [email-masked] <mailto:[email-masked]>
> https://www.ietf.org/mailman/listinfo/txauth <https://www.ietf.org/mailman/listinfo/txauth>

---

From: David Skaife <[email-masked]>
Date: Sat, 21 Mar 2020 18:22:15 +0000

I think we're saying the same thing with regards to the working group name
- I was saying it *isn't* particularly important in comparison to the name
of the protocol (which obviously is very important).

On Sat, Mar 21, 2020 at 6:18 PM Justin Richer <[email-masked]> wrote:

> I disagree on the working group name being super important. Nobody knows
> that the OAuth WG is actually named “The Web Authorization Protocol Working
> Group”, and nobody cares.
>
> My proposal is that we name the protocol we work on “TxAuth” (and keep the
> mailing list), and that we name the working group something like “Next
> Generation Web Authorization Protocol” to say what we’re doing.
>
>  -- Justin
>
> On Mar 21, 2020, at 2:08 PM, David Skaife <
> [email-masked]> wrote:
>
>> As you can see in the email you replied to, that is not even close to
>> what I said. I believe it is a transaction, and therefore, I do not agree
>> that it’s not a transaction.
>>
>>> None of the arguments below in favor of XAuth have made me like that
>>> name better. If it’s just a “placeholder” name, then why come up with
>>> something new?
>>>
>>>  — Justin
>>>
>>>> And to Dick’s rationale for the name below, I absolutely do NOT see
>>>> this work as “OAuth with all the extra features”. I think that does a
>>>> disservice to the kind of change we have an opportunity to make here.
>>>>
>>>
>>> From the charter
>>>
>>>> A recent example that comes to mind are the privacy related works on
>>>> the browser storage API. Given that name, one would think that it is local
>>>> I chose XAuth in my draft to reflect the eXtensibility goal that we
>>>> have over OAuth -- and XAuth is OAuth but with an X to reflect all the
>>>> extra features. =)
>>>>
>>>> Other suggestions?
>>>>