Subject: [webfinger] All the DISCUSS positions on draft-ietf-appsawg-webfinger

From: Barry Leiba <[email-masked]>
Date: Thu, 11 Apr 2013 18:30:45 -0400

> Some Aggressive AD has entered the following ballot position for
> draft-ietf-appsawg-webfinger-12: Discuss

OK, well, I know this is how it feels, and, as we have six DISCUSS
positions on the document, some of them quite involved, with many
sub-issues, I know it's quite frustrating.

Let me try to manage the discussion and get us moving forward.

I'd like to start breaking the discussion down and addressing one
major issue at a time, avoiding 10-page, unreadable messages.  When
things get that involved and we're trying to deal with so many issues
at once, we lose track of where we are in the different sub-threads,
screw up the interactions among issues, and generally whirl like
dervishes.

After each major issue is settled (or we think it is), I'd like the
editors to post another revised I-D with text changes for that issue.
We'll then confirm that the issue has been put to bed, and start on
the next.

+++ ACTION: Appsawg Chairs +++
I think it would be useful for the appsawg chairs to start creating
issues in the tracker for each main item that the ADs have identified.
 Please see the IESG Evaluation record here:
https://datatracker.ietf.org/doc/draft-ietf-appsawg-webfinger/ballot/

Please work with the ADs to concisely list their major issues, put in
a form where they can be itemized in the tracker.  DO NOT WORRY about
getting everything on the first pass.  If we can identify, say, half a
dozen major issues, we can do another pass on it for the next set of
lesser issues when these are sorted out.

+++ ACTION: Document editors +++
While we sort out the issues, please post a revised I-D that includes
any agreed-to changes that you've accumulated so far.  This will give
us a new starting point for discussion, making sure that we don't have
to revisit the things we've already closed on.

As a starting point for the issue discussion, let me set out two major
issues that I want to go with first:

1. Privacy of the information returned by the WF server.

I think the intent here is that WF servers will generally be used to
get information that is already exposed through other means (for
instance, getting someone's Facebook profile as a JRD through WF, as
opposed to getting it by visiting the Facebook profile page through
HTTP).  The information returned could vary, depending upon whether
and with what identity the client is authenticated.  In other use
cases (such as with the acct: URI), the intent is specified in Section
8.2, "WebFinger MUST NOT be used to provide any personal data to any
party unless explicitly authorized by the person whose information is
being shared. Publishing one's personal data within an
access-controlled or otherwise limited environment on the Internet
does not equate to providing implicit authorization of further
publication of that data via WebFinger."

Some ADs think that this is not sufficiently specified: there's
insufficient discussion of the use cases, the access controls, the
authentication, and so on.  Let's start by sorting this out, and
making sure that what's in the document makes the intent and
responsibility clear.

After that's done...

2. What information is actually returned, and how can the client understand it?

The JRD includes, in the "links" array, items with "rel" values.  For
a client to understand what it gets in the JRD, it needs to understand
the "rel" values.  But there's no base set, and, so, with the base WF
protocol as specified here, no client will understand anything it gets
from any WF server.  Want to know where my blog resides?  The example
in Section 3.1 isn't going to help, because there's no "rel" defined
that will tell you that.  Want my email address?  My full name?  My
telephone number?  My preferred IM system and identifier?  Sorry, no
"rel"s defined to tell you that.

We need to have a discussion about the best way to set up (1) a
starting set of reasonable "rel" values that will provide useful
information for the initial use cases, and (2) a recommended mechanism
for extending that interoperably.

I think this should keep us busy for a bit.  Editors, chairs... can
you get started on your action items, above?  Once we have a revised
I-D, let's get the discussion going on issue 1 above.

And let's please keep the distribution list that's on this message for
the whole conversation (though you can remove me from explicit copy:
I'll get the messages on the webfinger and iesg lists):
  To: [email-masked]
  CC: [email-masked]>, [email-masked], [email-masked]

Thanks, all, and let's work on resolving these issues.

Barry, Applications AD

---

From: "Paul E. Jones" <[email-masked]>
Date: Thu, 11 Apr 2013 23:21:53 -0400

Barry,

> to revisit the things we've already closed on.

I have quite a number of edits to the text already.  I will give it to a few
folks for review and try to post a revised document on Monday evening.

Paul

---

From: Barry Leiba <[email-masked]>
Date: Wed, 17 Apr 2013 09:42:54 -0400

OK, everyone: Paul has released -13, and Stephen has updated his
DISCUSS text to account for this version.  Thanks, both of you, and I
ask the other ADs with DISCUSS positions to do the same (I have
explicitly put you in the "to" list here) -- and there's still an
action item for the appsawg chairs to help them with this, and to

> We'll then confirm that the issue has been put to bed, and start on

My next message will kick us off into the first issue.

Barry, Applications AD

---

From: Barry Leiba <[email-masked]>
Date: Wed, 17 Apr 2013 09:49:40 -0400

> making sure that what's in the document makes the intent and

Stephen, I note that your current DISCUSS has move this out of the
major issue list and into the comments:

> - 8.2, this is outstandingly glib: "If one does not wish to
> share certain information with the world, do not allow that
> information to be freely accessible on the Internet or
> discoverable via WebFinger" - most users are never given a
> choice as to whether or not much of their information is
> freely accessible or not. I think the best that can be done
> with that is to delete it.

Is this general issue still of top importance to discuss?  I think
it's really Stephen and Richard who need to weigh in on that.  And
Joel isn't happy with the way 2119 language is used to express this:

> 8.2
>
>    Further, WebFinger MUST NOT be used to provide any personal data to
>    any party unless explicitly authorized by the person whose
>    information is being shared.
>
> This is a usage guideline not a part of the protocol specification. At a
> minimum it should use non-normative language. probably it should be replaced
> with a description of the potential for exposure.

At this point, I think we're not far from settling the general issue
at hand.  Stephen, Richard: where do you think we stand on it in
version -13?

(I realize, Stephen, that you have other concerns about privacy; I'm
explicitly not getting to those yet.  First I want to cover the
general discussion about how webfinger provides access to
information.)

Barry

---

From: Stephen Farrell <[email-masked]>
Date: Wed, 17 Apr 2013 17:03:07 +0100

Hiya,

> We're ready to wade into the first issue:

Ok.

>> 8.2, 

I'll start here:

>> "WebFinger MUST NOT be used to provide any personal data to any
>> being shared. 

I do think the above isn't well specified. And that does touch
on my discuss point #1, even if that wasn't very clear (my
fault;-) I agree that we're probably better off starting with
fixing this bit though regardless of how discuss points are
written up.

The MUST NOT could be read to mean that Alice has to say who is
and who is not allowed access to Alice's information when she decides
to make that available via WF. Its not clear that the "explicitly
authorized" means only "by Alice for whoever the WF service allows"
and not e.g. "by Alice for Bob" or "by Alice for her friends" or
"by Alice for people in .de"

Now I know that the intent is not to require Alice to specify
who can access her stuff, but it could be read to mean that,
e.g. by some over-zealous regulator. (And that over-zealous
regulator might then say that having the automated access in
3.1 succeed isn't ok, which is the link to my discuss point #1.)

I think what was meant was more like:

   WebFinger MUST NOT be used to provide any personal data unless
   publishing that data via WebFinger by the relevant service
   was explicitly authorized by the person whose information
   is being shared.

I think that (or an equivalent) were stated in 8.2 then that'd
be better and would break the link with my discuss point#1.
(It doesn't clear discuss point#1 though.)

It might also imply that if the terms of service change then
maybe the WF operator needs to ask Alice again, I don't know.
(Not that they would or anything;-)

>> Publishing one's personal data within an

Nah, that was always just a non-blocking comment. I do
still think the statement is glib though, and would be
better deleted. Most real users don't have a real choice
here and pretending they do is bogus. They do have a
choice to use or not use some service, but at a much
higher level than we generally mean with that term.
E.g. they might use or not use FB or G+ but after that
most of the rest is just pretence that the user has a
real choice as to what else happens with their data.

>> with a description of the potential for exposure.

I would argue that its a valid MUST NOT since it addresses
a security/privacy issue even if not an interop issue, so
I'd rather keep the 2119 term. I agree that might not be a
winning argument. For security it would be valid I think
to say you MUST NOT use a crap PRNG which is arguably
similar enough. We don't have such a consensus for privacy
related statements afaik, though perhaps we ought try to
develop that. In any case, the MUST NOT doesn't hurt anyone
and does help some folks, so I'd say keeping it is better.
(I'd live with a non-normative statement, if need be.)

> general discussion about how webfinger provides access to

Tried to stick to that above. Let's see how it pans out,
Cheers,
S.

---

From: "Paul E. Jones" <[email-masked]>
Date: Thu, 18 Apr 2013 04:19:29 -0400

Stephen,

>    was explicitly authorized by the person whose information

Yeah, that's the intent.  Your wording sounds fine to me.
 
> (Not that they would or anything;-)

Don't go boil an ocean.
 
> real choice as to what else happens with their data.

Don't ask me to try to defend a statement in the privacy section.  I already
think it goes overboard and tries to scare people into not using WebFinger.
Substitute WF with (whatever service) and it's true.  So, I'm not sure what
to do with it.  I would not hesitate to remove it if asked.

And while we're at it, can we remove WF being a tool that enables a person
"to inflict harm" on someone?

> (I'd live with a non-normative statement, if need be.)

So, do we make it lowercase or change it to REALLY SHOULD NOT? ;-)

Paul

---

From: Stephen Farrell <[email-masked]>
Date: Thu, 18 Apr 2013 10:09:42 +0100

Hi Paul,

> Yeah, that's the intent.  Your wording sounds fine to me.

So I think on this point the remaining issue is for the folks
who think the 2119 term above is bogus to speak up. (And just
lower casing is not a fix, we don't have IETF consensus as to
whether or not that makes any difference.)

I think using MUST NOT there is good I guess its over to Joel
who has the opposite opinion in his discuss.

S.

---

From: "Paul E. Jones" <[email-masked]>
Date: Thu, 18 Apr 2013 21:52:53 -0400

What about the statement in the privacy section.  Leave it or remove it?

Paul

> -----Original Message-----
> From: Stephen Farrell [mailto:[email-masked]]
> Sent: Thursday, April 18, 2013 5:10 AM
> To: Paul E. Jones
> Cc: 'Barry Leiba'; [email-masked]; [email-masked];
> 'The IESG'; [email-masked]
> Subject: Re: All the DISCUSS positions on draft-ietf-appsawg-webfinger
> 
> 
> Hi Paul,
>

---

From: Stephen Farrell <[email-masked]>
Date: Fri, 19 Apr 2013 15:35:16 +0100

> What about the statement in the privacy section.  Leave it or remove it?

Just to be sure, you mean this one:

  "If one does not wish to
   share certain information with the world, do not allow that
   information to be freely accessible on the Internet or
   discoverable via WebFinger"

I'm for taking it out. The MUST NOT phrase does the job and this
doesn't help IMO. But its a comment, so up to you and Barry as
far as I'm concerned.

S.

---

From: "Paul E. Jones" <[email-masked]>
Date: Fri, 19 Apr 2013 18:42:33 -0400

I'm OK with deleting that.  I'll delete it from my text unless someone
objects.

Waiting on direction for the MUST NOT part.

Paul

> Sent: Friday, April 19, 2013 10:35 AM
> To: Paul E. Jones
> Cc: [email-masked]; [email-masked]; 'Barry Leiba';
> >>>>>> party unless explicitly authorized by the person whose
> information
> >> is
> >>>>>> being shared.
> >>>>
> >>> Substitute WF with (whatever service) and it's true.  So, I'm not
> sure
> >> what
> >>>>>>    Further, WebFinger MUST NOT be used to provide any personal
> data
> >>>> to
> >>>>>> This is a usage guideline not a part of the protocol
> specification.
> >>>> At a
> >>>>>> minimum it should use non-normative language. probably it should
> be
> >>>> replaced

---

From: Barry Leiba <[email-masked]>
Date: Sat, 20 Apr 2013 05:47:36 -0400

> Waiting on direction for the MUST NOT part.

Go ahead and take that out, and post.  Then we can start discussion on the
second issue for which Pete is the lead AD.

Barry

On Friday, April 19, 2013, Paul E. Jones wrote:

> > From: Stephen Farrell [mailto:[email-masked] <javascript:;>]