Subject: IETF Chair

From: "Salz, Rich" <[email-masked]>
Date: Tue, 6 Oct 2020 20:00:30 +0000

I am standing for IETF Chair.  As with my previous IESG attempts, I will be putting all my documentation online; it’s at
https://github.com/richsalz/ietf-nomcom
Issues and pull requests welcome, although there’s only a week for me to finish.

I encourage all nominees to publish their questionnaire responses as well.  The more transparency the better.

                /r$

---

From: Brian E Carpenter <[email-masked]>
Date: Wed, 7 Oct 2020 09:15:03 +1300

Rich,

Thanks for the transparency.

I would be very happy if someone with more recent experience wanted to update https://tools.ietf.org/html/draft-carpenter-ietf-chair-tasks-00, which is certainly out of date by now.

I'll also take the liberty of mentioning my open letter to NomCom, at https://www.ietf.org/id/draft-carpenter-nomcom2020-letter-00.html .

Regards
   Brian Carpenter

---

From: Sarah Banks <[email-masked]>
Date: Tue, 6 Oct 2020 14:04:08 -0700

Hi Rich,
    Thanks for sharing this. I really appreciate the transparency; I'd have to go back into the archives to see if anyone has publicly "released" their AD form/submission, but it says a lot about your values and your style to share it. Regardless of how this turns out, it's commendable that you shared it for others to learn from; both in your specific style and approaches, but also a peek into how the process runs and how someone answers the form. It's also so, so nice to send a "thank you" note to the IETF list :) Thank you!

Cheers,
Sarah

> On Oct 6, 2020, at 1:00 PM, Salz, Rich <rsalz=[email-masked]> wrote:
> 
> https://github.com/richsalz/ietf-nomcom <https://github.com/richsalz/ietf-nomcom>

---

From: Carsten Bormann <[email-masked]>
Date: Wed, 7 Oct 2020 01:38:07 +0200

On 2020-10-06, at 22:00, Salz, Rich <rsalz=[email-masked]> wrote:
> 
> I will be putting all my documentation online

(Teacher’s knee jerk response: 
Oh no, somebody posted a solution.
I’ll need to change the assignment next year…)

I like the spirit, but I also can appreciate that won’t be the right approach for everyone.

Grüße, Carsten

---

From: Khaled Omar <[email-masked]>
Date: Wed, 7 Oct 2020 19:11:13 +0000

Before I go on e-mails and forget, I wish you good luck Rich.

Khaled Omar

From: ietf <[email-masked]> On Behalf Of Salz, Rich
Sent: Tuesday, October 6, 2020 10:01 PM
To: [email-masked]
Subject: IETF Chair

                /r$

---

From: "Salz, Rich" <[email-masked]>
Date: Tue, 13 Oct 2020 15:45:32 +0000

I just sent in my questionnaire answers.  They’re in the GH repo, if you want to use it to help send feedback :)

From: Rich Salz <[email-masked]>
Date: Tuesday, October 6, 2020 at 4:00 PM
To: "[email-masked]" <[email-masked]>
Subject: IETF Chair

                /r$

---

From: Timothy Mcsweeney <[email-masked]>
Date: Tue, 13 Oct 2020 13:55:39 -0400 (EDT)

I think I like where you're going with this transparency Rich!  To highlight, here are a couple zingers I found in your answers to the questionnaire:

"Sadly, right now the IETF often looks more like a colonial empire than something like the UN."

"Akamai gets indirect value were I to become the Chair."

"I am not a professional standards person, I am an implementor who needs standards to succeed."

"I bring an understanding of what it means to be a respectful and inclusive person, knowing that I am a privileged member of society."

This last one is not a zinger but I wanted to include it because of its irony to me personally:  “We need to make sure that anyone with an interesting idea for an Internet protocol will feel welcome to bring it forward, and continue to feel welcome even if their idea has already been considered and dropped.”

---

From: Khaled Omar <[email-masked]>
Date: Tue, 13 Oct 2020 18:10:12 +0000

Hi,

Let me add something from what I’m expecting to see from the IETF in the next coming years.

I expect to see fair evaluation for ideas with no prejudice to a specific agenda or policy and the only one prejudice is for making the internet work better even if the idea will add a small difference, the most important is that it add something NEW with value.

I expect also that people respect ideas and if you have not something good to say, then avoid the discussion.

I expect more contribution by official assignment by the chair to review and evaluate ideas scientifically and let the implementer decides whether to use it or not, I think this is the main goal of the IETF, to produce new standards and let implementers have the choice.

There is a big role that should be done by IETF members, which is not to allow the destructive criticism especially for good ideas, all have minds to understand and evaluate.

Best regards,

Khaled Omar
From: ietf <[email-masked]> On Behalf Of Timothy Mcsweeney
Sent: Tuesday, October 13, 2020 7:56 PM
To: Salz, Rich <rsalz=[email-masked]>; [email-masked]
Subject: Re: IETF Chair

---

From: Kyle Rose <[email-masked]>
Date: Tue, 13 Oct 2020 14:48:40 -0400

> I expect to see fair evaluation for ideas with no prejudice to a specific agenda or policy and the only one prejudice is for making the internet work better even if the idea will add a small differ…

Inclusion does not relieve you of the burden of convincing others that
your proposals serve a unique, un-met need, are technically feasible,
and are worthy of attention relative to all the other work going on at
the IETF so as to build a sufficient core to move that work forward.

> I expect also that people respect ideas and if you have not something good to say, then avoid the discussion.

That's not how any of this works. If an idea is bad, I expect
engineers to say so. What we should not do is discount an idea based
on the race, ethnicity, creed, etc. of those proposing it. I see no
evidence that any such thing has happened in the IETF, at least since
I've been participating.

Indeed, one of the critical functions of the IETF (and, really, any
SDO) is to discriminate: between good and bad ideas, productive and
unproductive uses of time, between work that advances our shared
values and work that opposes it. You will not get much support for
rubber stamping anyone's proposals regardless of merit.

Kyle

---

From: Khaled Omar <[email-masked]>
Date: Tue, 13 Oct 2020 18:57:16 +0000

>> Inclusion does not relieve you of the burden of convincing others that your proposals serve a unique, un-met need, are technically feasible, and are worthy of attention relative to all the other work going on at the IETF so as to build a sufficient core to move that work forward.

I didn't mean that all members do the opposite, my proposals are clear since the beginning, but no official action has been taken which is out of my hand, I can go out easily and say this idea is bad without a technical proof, but that will not make my ideas count.

>> That's not how any of this works. If an idea is bad, I expect engineers to say so. What we should not do is discount an idea based on the race, ethnicity, creed, etc. of those proposing it. I see no evidence that any such thing has happened in the IETF, at least since I've been participating.

I agree with this, but some people don't want to let good ideas to go forward for their own reasoning, (agenda, hat, policy, setc) which shouldn't have a place here.

Khaled Omar

-----Original Message-----
From: Kyle Rose <[email-masked]> 
Sent: Tuesday, October 13, 2020 8:49 PM
To: Khaled Omar <[email-masked]>
Cc: Timothy Mcsweeney <[email-masked]>; Salz, Rich <rsalz=[email-masked]>; [email-masked]
Subject: Re: IETF Chair

> I expect to see fair evaluation for ideas with no prejudice to a specific agenda or policy and the only one prejudice is for making the internet work better even if the idea will add a small differ…

Inclusion does not relieve you of the burden of convincing others that your proposals serve a unique, un-met need, are technically feasible, and are worthy of attention relative to all the other work going on at the IETF so as to build a sufficient core to move that work forward.

> I expect also that people respect ideas and if you have not something good to say, then avoid the discussion.

That's not how any of this works. If an idea is bad, I expect engineers to say so. What we should not do is discount an idea based on the race, ethnicity, creed, etc. of those proposing it. I see no evidence that any such thing has happened in the IETF, at least since I've been participating.

Indeed, one of the critical functions of the IETF (and, really, any
SDO) is to discriminate: between good and bad ideas, productive and unproductive uses of time, between work that advances our shared values and work that opposes it. You will not get much support for rubber stamping anyone's proposals regardless of merit.

Kyle

---

From: Kyle Rose <[email-masked]>
Date: Tue, 13 Oct 2020 15:02:40 -0400

> I didn't mean that all members do the opposite, my proposals are clear since the beginning, but no official action has been taken which is out of my hand, I can go out easily and say this idea is b…

You may wish to read this if you haven't:

https://www.ietf.org/about/participate/tao/

I mention it because your statement seems to imply the IETF is a
top-down organization. It is not. "Official action" is taken in
response to work being proposed by participants. There is very little
agenda driven from the leadership down (and in fact there has been
much resistance to such attempts over the IETF's long history). Of
particular note is section 5 on BoFs, or "birds of a feather"
meetings. The bottom line is that you get the IETF to do work by first
doing it yourself and then convincing others to go along with it.

Kyle

---

From: Timothy Mcsweeney <[email-masked]>
Date: Tue, 13 Oct 2020 15:04:02 -0400 (EDT)

Hi Kyle,

>rubber stamping anyone's proposals regardless of merit.

Isn't there usually a distinction between the standard and the implementation?  For example, if a 2x4 is a standard for building stuff, should the 2x4 standard body care if you use it to build a villa or a dog house?  Or maybe a better question is, shouldn't standards be made in a way that allows anyone to implement?  And if nobody is implementing something, can it still be considered a standard?

Tim

---

From: Khaled Omar <[email-masked]>
Date: Tue, 13 Oct 2020 19:13:53 +0000

>> Or maybe a better question is, shouldn't standards be made in a way that allows anyone to implement?  And if nobody is implementing something, can it still be considered a standard?

I agree with what you said if it is not a question.

Khaled Omar

From: Timothy Mcsweeney <[email-masked]>
Sent: Tuesday, October 13, 2020 9:04 PM
To: Kyle Rose <[email-masked]>; Khaled Omar <[email-masked]>
Cc: Salz, Rich <rsalz=[email-masked]>; [email-masked]
Subject: Re: IETF Chair

Hi Kyle,

Tim

---

From: Carsten Bormann <[email-masked]>
Date: Tue, 13 Oct 2020 22:15:27 +0200

I didn’t read the whole thing yet, but …

> “We need to make sure that anyone with an interesting idea for an Internet protocol will feel welcome to bring it forward, and continue to feel welcome even if their idea has already been considered and dropped.”

This has been an important objective for a while, and we’ll need to make sure we don’t alienate potential future (or present!) contributors while they are still in the process of learning a specific field.

An interesting objective for the IETF chair would be to figure out how to do this, while also finding ways to waste less time and energy on contributors that receive plenty, unanimous advice why their proposal doesn’t work/help and then continue to bring the same thing up again and again.  We probably need a few more circuit breakers.
Note that this is in the interest of those very contributors who might otherwise permanently damage their professional reputation.  Worse for the objectives of the IETF, others might see this happen and shy back from contributing ideas because "they don’t want to be like X” (which they aren’t as long as they are exhibiting signs of learning).

Grüße, Carsten

---

From: Khaled Omar <[email-masked]>
Date: Tue, 13 Oct 2020 20:25:31 +0000

>> We probably need a few more circuit breakers.

Take it or leave it is a good way, compromised decision is not from wisdom, from my side, I'm waiting for an official decision regarding my proposals 4 years ago, I hope I won't wait more.

mit herzlichen grüßen,

Khaled Omar

-----Original Message-----
From: ietf <[email-masked]> On Behalf Of Carsten Bormann
Sent: Tuesday, October 13, 2020 10:15 PM
To: Salz, Rich <rsalz=[email-masked]>
Cc: [email-masked]
Subject: Re: IETF Chair

Grüße, Carsten

---

From: "Salz, Rich" <[email-masked]>
Date: Tue, 13 Oct 2020 20:59:57 +0000

> from my side, I'm waiting for an official decision regarding my proposals 4 years ago, I hope I won't wait more.

You do not have to wait.  There is no official decision.  If you want to write a document and present it to one of the "dispatch" working groups, you can get some opinions.

But you have already gotten several opinions. Most of the technical ones disagree, saying it won't work, if only because it is too hard to deploy. But you also got suggestions to find people who agree with you as a first step.  Have you done that?  Then start writing a document that people can comment on.

---

From: Timothy Mcsweeney <[email-masked]>
Date: Tue, 13 Oct 2020 17:01:59 -0400 (EDT)

Carsten,

>An interesting objective for the IETF chair would be to figure out how to do

>this, while also finding ways to waste less time and energy on contributors

>that receive plenty, unanimous advice why their proposal doesn’t work/help

>and then continue to bring the same thing up again and again. We probably

>need a few more circuit breakers.

What's needed is an automated nits checker for protocol parameters like is used with draft submission.  That would negate the need for all kinds of wasted time for the IESG, designated experts and arguments over RFC intent.  Plus new implementors wouldn't have to keep hearing the same explination on why it won't work over and over again :-)  Either it goes through or it doesn't.

---

From: Khaled Omar <[email-masked]>
Date: Tue, 13 Oct 2020 21:03:11 +0000

What if some agree and some don't agree, how to measure consensus?

That’s why IMHO there should be an official decision or nothing will change.

Khaled Omar

---

From: "Salz, Rich" <[email-masked]>
Date: Tue, 13 Oct 2020 21:12:19 +0000

Historically, the people who put in the work "win" (bad word).

What work have you done, other than posting messages that have gotten replies that you don't like?

---

From: Khaled Omar <[email-masked]>
Date: Tue, 13 Oct 2020 21:15:37 +0000

I have 5 proposals with the IETF:

1) IPv10.
2) KHALED Routing Protocol (KRP).
3) Numbering Exchange Protocol (NEP) ..... this idea was stolen.
4) Satellite Internet (SI).
5) ASN Label Switching Protocol (ALSP).

None of them taken seriously except one, the 3rd, taken not seriously and idea was stolen by Cisco.

Best regards,

Khaled Omar

---

From: Khaled Omar <[email-masked]>
Date: Tue, 13 Oct 2020 21:34:11 +0000

Something else, most of the discussions was related to changing drafts' names, for example BefoRe IANA taken any reservation to version number 10 in the internet protocol, I suggested using this number as a good indicator to the idea, because it reflects the meaning of the draft and will be used technically, but there was no reviews or any official decision regarding whether this draft should be considered at the IETF or to be neglected and no more discussion about it, this is what I call, take it or leave it.

Best regards,

Khaled Omar

-----Original Message-----
From: ietf <[email-masked]> On Behalf Of Khaled Omar
Sent: Tuesday, October 13, 2020 11:16 PM
To: Salz, Rich <[email-masked]>
Cc: [email-masked]
Subject: RE: IETF Chair

1) IPv10.

Best regards,

Khaled Omar

---

From: Mezgani Ali <[email-masked]>
Date: Tue, 13 Oct 2020 22:51:00 +0100

Hello,

The name chosen are no familiar and reflect a malicious semantic. For start posting into the IETF and became Internet Engineer, 
I purpose to read a lot of drafts and start working with Work Groups that exist. ( Babel for example ) 
Do expansion of existing projects maybe report patches.

As I told before no need to do IPv10, KRP is a bad nomination, Satellite Internet: what do you mean by that ?
ASN Label Switching Protocol never heard before.

But you still a good source of ideas and your motivation and perseverance to become Internet Engineer let me think about my last tweet.

Scan for Cisco routers set with default password on a WAN's telecom operator and hack into its.
Build a Graph of secure IPv6 or maybe a Binary tree with nodes, as you must be the Root. 
Insert SNMP sensors on them, Prometheus or Cacti will help to keep an eye on the bandwidths and ressources.
You will find by having a matrix store some hashes running on a Cassandra database. 
Create Matrix's function with most of Mathematics theories ( Algebra of Matrix, Analysis modules ), you have space now. 
Let's play now with sentinels. 
Aka Sentinel private tunnel ( GRE Tunnels overs IPv6 ) - ( A linked list of routers traveling inside the Multi-dimensional Array )

Kind regards,

Mezgani Ali
Tel: 00 212 679 119 530
LAB SMARTS : Secure and Mixed Architecture for Reliable Technologies and Systems
INPT - Rabat.
Morocco

> On Oct 13, 2020, at 22:15, Khaled Omar <[email-masked]> wrote:
>

---

From: Khaled Omar <[email-masked]>
Date: Tue, 13 Oct 2020 22:08:13 +0000

Excuse me, how no need to do IPv10 and KRP?! Almost same thing was said about NEP and then what, taken without notice.

Regarding Satellite Internet draft, read it first as the idea is clear there not as ALSP, the idea is not complete in the draft to avoid any kind of stealing again until I see serious conversations and technical discussions.

There are other ideas but will not be with the IETF but let tell you one idea name maybe you are curious to know: "Things Transmission over the Internet".

Khaled Omar

From: Mezgani Ali <[email-masked]>
Sent: Tuesday, October 13, 2020 11:51 PM
To: Khaled Omar <[email-masked]>
Cc: Salz, Rich <[email-masked]>; [email-masked]
Subject: Re: IETF Chair

Hello,

Kind regards,

Mezgani Ali
Tel: 00 212 679 119 530

On Oct 13, 2020, at 22:15, Khaled Omar <[email-masked]<mailto:[email-masked]>> wrote:

1) IPv10.

Best regards,

Khaled Omar

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Tue, 13 Oct 2020 19:22:10 -0400

On Tue, Oct 13, 2020 at 1:56 PM Timothy Mcsweeney <[email-masked]>
wrote:

> I think I like where you're going with this transparency Rich!  To
> highlight, here are a couple zingers I found in your answers to the
> questionnaire:
>
> "I bring an understanding of what it means to be a respectful and
> inclusive person, knowing that I am a privileged member of society."
>
> This last one is not a zinger but I wanted to include it because of its
> irony to me personally:  “We need to make sure that anyone with an
> interesting idea for an Internet protocol will feel welcome to bring it
> forward, and continue to feel welcome even if their idea has already been
> considered and dropped.”
>

I think the last point is worth emphasizing because there are pressures in
Academia and commerce to chase the latest bright shiny object and that is
not necessarily the solution to the problems we are facing today.

The biggest security problem we face today is breach of data at rest, a
confidentiality problem. But 90% of the efforts of the academy and 99% of
those of commerce are focused on the Blockchain, an integrity technology.
Meanwhile it has taken me most of the last five years working in various
forums to persuade people to look at threshold decryption, a technology
developed in the 1990s that is actually a confidentiality control capable
of securing data at rest.

It is only sometimes the case that a problem and a solution arrive at the
same time. While it seems that the solution always trails the problem, the
reverse is just as likely. And often a solution does not come at a time it
can be applied. If someone tried to make use of the systems I am using in
the Mesh on a 1990s era $80,000 engineering workstation they would be an
unhappy camper. If they tried it on a PC they would be even more unhappy.
These days you can run the same level of crypto on a Raspberry Pi.

The only caveat I would add is that when someone proposes addressing an
issue someone else has been campaigning on for five or ten years and told
that it isn't interesting, they should get a share in the credit when it is
recognized that the time is right.

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Wed, 14 Oct 2020 10:14:51 -0400

> Historically, the people who put in the work "win" (bad word).

Historically, the people who have the right connections win.

I proposed encrypting the client-resolver connection in DNS on multiple
occasions for four years before the DPRIV BOF. Each time I was told, 'not
interested, there is no need'.

Then suddenly people decided there was a need. A need so urgent that there
had to be a solution in 12 months. So PHB's proposal which was designed to
directly layer on UDP using a direct key exchange would take too long to
complete. The solution (obviously) was to run the DNS protocol over TLS
using the new TCP fast start to overcome the resulting latency issues. And
of course this proposal was very popular with people who had worked on fast
start because that would bring them rapid deployment because everyone wants
DNS privacy.

Only they didn't. And now six years after the Honolulu BOF, I still can't
actually use DPRIV to secure any of my systems because none of the platform
or browsers providers support it or plan to do so.

And I am not the only person who keeps having this sort of thing happen. I
am just the person who makes a point of continually reminding people of the
failure in the hope the process might be different next time round. No it
won't be. In fact it's happening again right now.

People here were mighty upset when we started W3C and then the W3C folk got
upset when some of us turned OASIS into what it is now. I don't like the
business model of those organizations but they did get the work done.

---

From: "Theodore Y. Ts'o" <[email-masked]>
Date: Wed, 14 Oct 2020 10:19:54 -0400

> of securing data at rest.

I'd agree, but at the same time, I'll note that securing data at rest
is generally not an issue which is solved via internet protocols and
interoperability guarantees, but rather is something that needs to be
designed in hardware (e.g., trusted key stores, firmware verification)
and in software (trusted boot, multiple layers of encryption in the
software stack, bring your own key for those customers who demand it)
and in operational practices (reduction of people with privileged
access, two person controls, auditing, etc.).

An example of the sorts of things which are needed to secure data at
rest can be found here[1], from my employer, but all cloud providers
should have something similar (or they'd better, if they want to
retain customer trust).

[1] https://cloud.google.com/security/overview/whitepaper

If you look at this, you'll find that most of it is out of scope for
the IETF.

					- Ted

---

From: Leif Johansson <[email-masked]>
Date: Wed, 14 Oct 2020 16:28:04 +0200

Skickat från min iPhone

> 14 okt. 2020 kl. 16:16 skrev Phillip Hallam-Baker <[email-masked]>:
> 
> 
>> On Tue, Oct 13, 2020 at 5:12 PM Salz, Rich <rsalz=[email-masked]> wrote:

+1

> I proposed encrypting the client-resolver connection in DNS on multiple occasions for four years before the DPRIV BOF. Each time I was told, 'not interested, there is no need'.
> 
> Then suddenly people decided there was a need. A need so urgent that there had to be a solution in 12 months. So PHB's proposal which was designed to directly layer on UDP using a direct key exchange would take too long to complete. The solution (obviously) was to run the DNS protocol over TLS using the new TCP fast start to overcome the resulting latency issues. And of course this proposal was very popular with people who had worked on fast start because that would bring them rapid deployment because everyone wants DNS privacy.
> 
> Only they didn't. And now six years after the Honolulu BOF, I still can't actually use DPRIV to secure any of my systems because none of the platform or browsers providers support it or plan to do so.
> 
> And I am not the only person who keeps having this sort of thing happen. I am just the person who makes a point of continually reminding people of the failure in the hope the process might be different next time round. No it won't be. In fact it's happening again right now.
> 
> 
> People here were mighty upset when we started W3C and then the W3C folk got upset when some of us turned OASIS into what it is now. I don't like the business model of those organizations but they did get the work done.

---

From: Robert Sparks <[email-masked]>
Date: Wed, 14 Oct 2020 09:28:56 -0500

(Trivial reply to groom the subject. If other forks of the thread 
continue, I hope the next poster there does the same).

RjS

---

From: Keith Moore <[email-masked]>
Date: Wed, 14 Oct 2020 11:20:18 -0400

> Historically, the people who have the right connections win.

Connections help, and timing helps too.   If you propose something at a 
time when the technology is just about ready, and there's an emerging 
awareness of the problem, and there's enough energy to overcome the 
inertia imposed by the status quo, it's a lot more likely to succeed 
than if you propose the same thing either too soon or too late.    
There's a strong bias against "old" ideas even if their time has now 
come; people would rather consider a new proposal than an old one.

Keith

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Wed, 14 Oct 2020 13:49:41 -0400

> access, two person controls, auditing, etc.).

That is how we have been trying to do it for 20 years. And the result was
the Snowden breach. If the NSA can't run that stack and make it work, it is
hardly surprising if nobody else can either.

All the things you describe are useful as part of a solution. But they
don't get to the heart of the matter which in my view is separation of
duties. You cannot expect security if you place absolute trust in any one
individual or service. There will always be an insider threat. Which is why
we need to divide the private keys. Once you start to look at applying
threshold on a large scale, it is clear that you need a threshold key
infrastructure to manage the issue and use of the key shares. And once you
start to look at managing the shares it becomes clear that you need to make
use of threshold techniques to do that.

> [1] https://cloud.google.com/security/overview/whitepaper

Right now, Google has how many billion passwords stored in its cloud
services?

One day, one of the lawyers will look at that and realize that you have
collected what one of my Microsoft friends used to describe as a steaming
pile of liability.

There are many commercial offerings out there but few that have even
explained their security controls and none that I am aware of that have
been subject to full public review. And it is hardly surprising that
password vaults have been one of the chief targets of hackers.

The problem with the password vault providers is that their mission is to
provide a proprietary solution that makes using passwords easy. What the
Internet desperately needs is a solution that provides a transition path
out of using passwords altogether.

Every device that is configured to use my password vault has end to end
security - the service provider does not have any form of access (that is
not a unique claim, but I have yet to see anyone else provide proof of that
claim). But the mechanisms I use to provision decryption key shares to
devices allowing them to access the password vault also provisions public
keys for authentication. So those devices can also authenticate using FIDO
(or equivalent). No smartcards needed.

> the IETF.

PKIX was IETF work and one of the few security area protocols that actually
succeeded. If PKI is in scope for IETF then TKI needs to be.

The audience I need to convince to make this work is not the audience here.
It is the board rooms. I used to sell seven figure PKIs to C-suite members.
In the 20 years I worked for other people, I made very sure that I kept on
top of every new technology that might affect our business so that when I
got a call from the CEO, I could tell them exactly what it was about.

Perhaps some folk here might want to start considering the power of
threshold encryption and what it means for cloud security now just in case
they get asked rather than reassuring themselves that the current approach
is working.

---

From: Barry Leiba <[email-masked]>
Date: Wed, 14 Oct 2020 15:16:01 -0400

> But 90% of the efforts of the academy and 99% of those of commerce are focused on
> the Blockchain, an integrity technology.

It's worse than that, because not only is most of the effort placed on
blockchain technology, blockchain technology is also being pushed as
the answer to *everything*.  Blockchain technology has a place, but it
doesn't make sense everywhere, and when one says, "Wait, let's take a
step back and look at what we really *need* blockchains for, and where
we don't," then one seems a heretic... or at best, quaintly naïve.

Barry

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Wed, 14 Oct 2020 16:13:05 -0400

> we don't," then one seems a heretic... or at best, quaintly naïve.

And it's even worse because Blockchain is not just a technology, it is an
ideology.

What is useful in Blockchain is the technology patented by Haber and
Stornetta in 1990. Extending one way functions to create one way sequences
is very powerful. We use that in Certificate Transparency. The idea of
using a one way sequence to anchor a naming system is very powerful and
should have been the basis for the RPKI (nobody wanted to listen).

But when people propose taking their problem and jamming it into
Blockchain, they are inheriting a whole bunch of legacy that really isn't
helpful. It is pretty easy to guess who Satoshi was and he knew he was
dying when he launched the scheme. He was a man in a very big hurry and he
was not designing a platform for the ages. BitCoin and the other
cryptocurrencies are currently consuming roughly 1% of global energy use.
The amount of electronic commerce taking place on BitCoin in goods other
than other crypto currencies is still a rounding error. A lot of people are
getting rich from what regularly turn out to have been Ponzi schemes.

I am not hitching my wagon to Blockchain because it is the regulatory
equivalent of a kick me technology. A practical model for ubiquitous end to
end security is enough of a political liability without building on a
platform whose only constituencies are drug peddlers, child abusers and
money launderers. Terrorists already know how to obtain end to end
encryption products that meet their needs, I do not know of any technology
that would prevent terrorists using existing end-to-end encryption schemes.
But I do know how to shut down the cryptocurrency world.

---

From: "John Levine" <[email-masked]>
Date: 14 Oct 2020 16:39:22 -0400

In article <[email-masked]> you write:
>> Blockchain technology has a place, ...

>Stornetta in 1990.

Yup, the timestamped ledger is indeed useful. The distributed
consensus part is a technical tour de force but is a problem
masquerading as a solution looking for a problem.

In my experience the only practical use of blockchain is as pixie dust
that people in big companies can sprinkle on otherwise boring but
worthy database reenginering projects to get upper management to fund
them. I suppose that's OK, but it's a rather narrow application.

R's,
John

PS: They published an article on it in 1990. They got a patent in 1994
on a tweaked version but the basic technology has always been
unencumbered. The patent expired in 2015 so the tweak is P.D. too.

---

From: Michael Thomas <[email-masked]>
Date: Wed, 14 Oct 2020 14:00:20 -0700

> we don't," then one seems a heretic... or at best, quaintly naïve.

What place might that be? I really can't think of any. Maybe you can use 
it for buying and selling tulips.

Mike

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Wed, 14 Oct 2020 19:00:49 -0400

> it for buying and selling tulips.

Every day thousands of courts are presented with digital evidence, pretty
much all of which should be excluded because it is far too easy to tamper
with. I have spent days engaged in pointless arguments over
admissibility that could be avoided entirely.

Every piece of digital evidence that is collected should be time stamped at
the time it is collected and enrolled in a notary service using a one way
sequence. At regular intervals, the notary offering this service should
cross notarize with other notary services, thus making it impossible for
any one notary to defect without detection unless every other notary
colludes. And NIST and every other national lab should run a national cross
notary service whose probity would be automatically considered valid by the
courts of that country.

That is not the sort of construct I see being built in blockchain land.
Noooo, much more fun selling virtual cowrie shells. But it is exactly the
sort of infrastructure we need.

The Mesh will (eventually) provide that capability once I have the Mesh
Naming System running. The objective is to provide the user with the
maximal degree of autonomy possible. So while most Mesh users are going to
outsource management of their Mesh to a service provider, I want to keep
the closest possible control over that provider, ensure that it is
accountable and provide for switching costs. One way sequence technology
provides the basis for accountability and allows a naming infrastructure
model that allows names to be provided for $0.10 for a life-long name
rather than renting them at $10/year.

Take away the stupidity, the criminality and the ecological disaster and
blockchain is built on a very powerful idea.

---

From: Benjamin Kaduk <[email-masked]>
Date: Wed, 14 Oct 2020 16:40:35 -0700

> sort of infrastructure we need.

Yup, that would be swell.  Too bad I don't have a budget to help make it
happen.

-Ben

---

From: Stephen Farrell <[email-masked]>
Date: Thu, 15 Oct 2020 00:52:06 +0100

> Yup, that would be swell.  Too bad I don't have a budget to help make it

An expired draft with some (fairly vague;-) ideas in that
space. [1] There are probably others too. Ours never went
anywhere (so far:-)

S.

[1] https://www.ietf.org/archive/id/draft-farrell-pkng-swig-00.txt

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Wed, 14 Oct 2020 22:10:43 -0400

I maintain a log of notable cryptographic patents and their expiry dates
and raised the imminent expiry of Haber Stornetta in PKIX a year before it
expired. I was very interested in 'Satoshi''s decision to launch bit
coin seven months before the patent expired. As we now know, Hal Finney had
just learned he had a terminal illness which is probably why he didn't want
to wait and why he chose to use the pseudonym.

The problem with blockchain is that the killer app as far as the VC is
concerned is to convert lead into gold. And the BitCoin bubble is really
quite spectacular unless you happen to track the prices of TSLA, NKLA, etc.
etc. on the NASDAQ. The market cap of BTC is a drop in the bucket compared
to the speculative value being placed on companies in the equity markets.
And unlike BTC... some of the companies make stuff and might even turn in a
profit that isn't an accounting fiction some day.

As with alchemy, there is real value there but the lead into gold part
isn't real no matter how many people clap their hands and say they believe
in tinkerbell.

To pick up the point made by John Levine, the ledger is useful, the
consensus mechanism is a problem, not a solution. It doesn't actually give
finality to transactions, they can be unwound with a 51% attack. Which
means that IF you have two cryptocurrencies that make use of the same
resource then one of them is vulnerable to a 25% attack. If you have a
hundred, its a 1% attack.

Oh and all the time this is burning up the planet and spewing CO2 into the
air. Having an algorithm that solves a problem is one thing. For an
algorithm to be useful we normally expect it to be efficient. Proof of
waste is an algorithm that by definition depends on its inefficiency.

If the data at rest problem has been solved then how come the CEO of one of
the largest Internet companies had his emails hijacked by a nation state
actor and leaked to destroy his marriage?

My system is working in the lab and pretty soon it will be deploying. And
once deployment happens it is going to be very difficult to make changes.

---

From: Amelia Andersdotter <[email-masked]>
Date: Thu, 15 Oct 2020 09:46:10 +0200

On 2020-10-14 17:20, Keith Moore wrote:
> Connections help, and timing helps too.   If you propose something at
> a time when the technology is just about ready, and there's an
> emerging awareness of the problem, and there's enough energy to
> overcome the inertia imposed by the status quo, it's a lot more likely
> to succeed than if you propose the same thing either too soon or too
> late.    There's a strong bias against "old" ideas even if their time
> has now come; people would rather consider a new proposal than an old one.
>
+1

The IETF can use procedures to make it more obvious who is exercising
what influence (and in other organisations it's common with such
procedures) but it's unlikely that connections/timing/politics will be
eradicated.

There's a very famous feminist text from the 1970s on specifically the
use of procedure to mitigate power imbalances:
https://www.jofreeman.com/joreen/tyranny.htm although Adam Curtis'
criticism of Buckminster Fuller's geodesic domes basically also
illustrate the same problem with structurelessness.

best regards,

-- 
^\...~...~...~...~...~.../^
Amelia Andersdotter
IETF SHMOO WG Co-Chair
https://datatracker.ietf.org/group/shmoo/about/

Director of Strategic Initiatives, CENTR
www.centr.org
^\...~...~...~...~...~.../^

---

From: Ben Laurie <[email-masked]>
Date: Thu, 15 Oct 2020 11:15:01 +0100

On Thu, 15 Oct 2020 at 00:01, Phillip Hallam-Baker <[email-masked]>
wrote:

> Every piece of digital evidence that is collected should be time stamped
> at the time it is collected and enrolled in a notary service using a one
> way sequence. At regular intervals, the notary offering this service should

This is effectively what Certificate Transparency does. And yes, the same
ideas should be used everywhere.

---

From: Larry Masinter <[email-masked]>
Date: Thu, 15 Oct 2020 22:04:17 -0700

This conversation seems to be about 'good ideas the IETF has ignored for
various (mainly stupid)  reasons."  But I can't tell what you expect the
IETF Chair to do?

On Wed, Oct 14, 2020 at 4:41 PM Benjamin Kaduk <[email-masked]> wrote:

> > > >> But 90% of the efforts of the academy and 99% of those of commerce
> are
> > > focused on
> at

-- 
--
https://LarryMasinter.net <http://larry.masinter.net>