Re: What problems are we trying to solve?

> when I had first seen your list, I had read that point with an
> emphasis on "discovered an attack", and had thought of heuristic
> techniques, IDS-like stuff, and so on.

Yes, that aspect too is out of scope.

> I do think that discussion on how user agents ought to react to
> failures of security protocols is in scope -- the prime example here
> being the MITM detection in SSL which is subverted by giving users
> an override button that they'll of course push.

It's my understanding that the charter defines our scope (our goals can be 
more targetted than the scope allows for). Is my understanding wrong? If 
not, what part of the charter supports that?
        Mez