Moving forward on draft-hartman-webauth-phishing

Hi, folks.  I'm not going to get much involved in the
procedural
discussion that Eric has raised.  As far as I'm concerned,
I've been
directed by my document shepherd and shepherding AD to hold
a
discussion to address comments received in last call on my
document
and I'm going to do that.  We all believed that having a
list other
than ietfietf.org to hold that discussion on would be good and
so
we're holding it here.

My goal is to improve the document so that when Alexey and
Lisa take
it back to the IESG and the IESG asks the community if the
document
addresses issues raised in last call and if there is
sufficient
consensus to publish that we'll make forwtard progress.

You can discuss all you want about whether this procedure is
the best
one to achieve that goal, but until Lisa or Alexey tells me
otherwise
then I'm going to go forward as they direct and focus on the
content
of the document.

I'd like to take a crack at addressing comments received in
last call
before we get too involved here, although I'll wart that may
take a
bit of time.  MIT is launching the Kerberos Consortium
September 27
and I'm heavily involved in that.  I don't know if I'll get
a new
revision out before then.


I don't view this document as just mine.  If I'm directed to
make
changes by one of the shepherds I'll make those changes.  If
I think
the document is watered down to a point where it has
insufficient
value, I may give up the pin or potentially ask to take the
text I've
written outside of the IETF process.  Obviously the IETF
could do
whatever it wants with that text as well; that's how our
process
works.

I don't want to get into where that role comes from; I don't
care
whether I'm an author or an editor and will not focus on
such
distinctions.  Ultimately my goal is to produce a useful
document that
can pass last call; I'm not at all sure what that makes me
and don't
much care.


Here are some of the issues that need to be addressed:

* Eric sent a lot of detailed comments that have not
received
  responses.  I'll need to respond to those.  I doubt I'll
make Eric
  happy, but I expect I'll be able to get to a point where a
lot of
  people other than Eric agree with my responses to his
comments.

* We need to clearly state what this document is trying to
do and to
  make sure that we ask the community for the appropriate
kind of
  consensus in an upcoming last call.


* We need to make sure the apps community and security
community have
  sufficient notice and opportunity to review.  I believe
Alexey has
  been and continues to work on that.

* I need to respond to Christian's review.

_______________________________________________
Ietf-http-auth mailing list
Ietf-http-authosafoundation.org
http://lists.osafoundation.org/cgi-bin/mai
lman/listinfo/ietf-http-auth

Hi Sam,

Can you point us to the document, and
Erics/Christians/others
comments/reviews please?

Kind Regards,
Chris Drake

_______________________________________________
Ietf-http-auth mailing list
Ietf-http-authosafoundation.org
http://lists.osafoundation.org/cgi-bin/mai
lman/listinfo/ietf-http-auth

Sure.  The draft is
http://tools.ietf.org/internet-drafts/dr
aft-hartman-webauth-phishing.txt

I'll forward the last call comments to this list.

_______________________________________________
Ietf-http-auth mailing list
Ietf-http-authosafoundation.org
http://lists.osafoundation.org/cgi-bin/mai
lman/listinfo/ietf-http-auth