Re: "Recommended" is a bad word :)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Rich,

I think Ryan's already responded to these comments, although thanks
for the filing the bug.

Do you view these comments as "formal objection"?

To clarify, that's a special term in W3C process, see here for a
definition:

"A Formal Objection to a group decision is one that the reviewer
requests that the Director consider as part of evaluating the related
decision (e.g., in response to a request to advance a technical
report). Note: In this document, the term "Formal Objection" is used
to emphasize this process implication: Formal Objections receive
Director consideration. The word "objection" used alone has ordinary
English connotations." [1]

Basically, it means you think its *really important*, so that it
should be discussed with the Director (Tim Berners-Lee) as we exit
Last Call.

While your comment does go conflict previous WG decisions and we can't
obviously list per-algorithm security considerations for every
possible primitive in a changing world where most security
considerations have to deal with their combinations in terms of
protocols, it is possible that the word "Recommended" could cause
confusion insofar as people may interpret it as "recommended for new
protocols" rather than "recommended for interoperability reasons".

Obviously, only in terms of new protocols is where the "don't release
weak crypto" arguments do apply, even though we hope that people do
not implement new protocols but instead ones that have a security
review, such as given by the IETF, as Ryan has explained.

Both the editor and WG have taken this comment on board and hopefully
you will be able to live with our resolution.

   cheers,
        harry

[1]
http://www.w3.org/2003/06/Process-20030618/policies.html#WGArchiveMinorityViews



On 05/08/2014 05:29 PM, Salz, Rich wrote:
> I just opened https://www.w3.org/Bugs/Public/show_bug.cgi?id=25607,
> "Need to advise authors about security considerations"
> 
> As it says in the entry, "This defect is in collaboration with
> Kenny Paterson. I believe that taking the fixes below will also
> address 18925, 23499, 25431 (maybe, by lack of use:), 25569."
> 
> The number of changes that need to be made is small, non-intrusive,
> and hopefully not controversial.  In addition to Kenny, thanks to
> Ryan for an interesting discussion (albeit mostly via twitter :).
> 
> /r$
> 
> PS:  As I am not on this list, please CC me on any replies.
> 
> -- Principal Security Engineer Akamai Technologies, Cambridge, MA 
> IM: rsalz@jabber.me<mailto:rsalz@jabber.me>; Twitter: RichSalz
> 
> 
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iQIcBAEBAgAGBQJTcJuvAAoJEPgwUoSfMzqc2nMP/1RX27jhclhNdg+HYZN06NuS
9Uetn22DBbs7/z5ZeaYC/B53GgtyvvJMn3oI8sgomzVkEPlRveP/JYU/oyZhZ63O
A7UFW8yINUV2IkAzTsAdRH28CZup/meTwJSBV+NTWbUmN5IajgaDnjqyl4tx42xI
/XaY3taJSjudEt7yUj7dTFN5QxTgq78UAUDkrV7pHXaY+xqjxtOpmgSpTcteG/wD
8lZ31VOGYUmwZB1DJIb9iF71MANQNaPZoGJpQ8B68sw+umb/lo7vRZwiOTmiUdrZ
NJjaKGKTj/KjlhOu5kmg5A60GwxHfDW9mgQrnjTxs2q1A4euoEv8vNSduL+Ik0TM
436N2APtsAsQ+9KXO9KIrsgiUOaat+7hRt1izcjKkupYQzfZiRsf/4TfPR+FgBGC
E3cMycNBnMIa7xdRWXk+T1PcWm3JqWf4oIagv/VnOMATg5q+PAv7sPcEcqsG7/Sz
Q3IGMmh21SfTbzZ+DJuvKTfIhmmykwgafQLeycW9HdCoZDMFI4ZQ6SrXHZDcJ0K4
45ddH7MU8xzpmSQwZfhStYdCkOX5a13VFzZ47u/JYBGVQ5V+lMhUlWww0Oc8+2EL
CcbNB/cZpwiCuHy4vyzC59MrpByY8iOhxPMuMGFIu0PsItXwgbtaR6B5DO5ZTyvM
t4aPy+BlUts6zGO5VNrA
=mWWB
-----END PGP SIGNATURE-----

Received on Monday, 12 May 2014 10:00:24 UTC