Re: Oauth blog post

2012-08-02 Thread Murray S. Kucherawy
On Sun, Jul 29, 2012 at 1:17 PM, Glen Zorn glenz...@gmail.com wrote: ** Do you think that corporate domination of open standards development is OK? Do you think that's actually what we do around here? I can think of counterexamples if you need some. -MSK

Re: Oauth blog post

2012-08-02 Thread Murray S. Kucherawy
On Mon, Jul 30, 2012 at 10:21 AM, SM s...@resistor.net wrote: Hi Hannes, At 12:19 PM 7/29/2012, Hannes Tschofenig wrote: The IETF allows open participation and, as such, everyone, including companies that develop enterprise software, are free to participate in the discussions. Do you

Re: Oauth blog post

2012-08-02 Thread SM
Hi Murray, At 09:13 AM 8/2/2012, Murray S. Kucherawy wrote: I think it's impossible to determine with certainty whether someone standing at the mic and asserting a position is doing so based on what an employer is insisting on doing, or that person's opinion. Yes. We purport to participate

RE: Oauth blog post

2012-08-02 Thread Worley, Dale R (Dale)
From: Murray S. Kucherawy [superu...@gmail.com] I think it's impossible to determine with certainty whether someone standing at the mic and asserting a position is doing so based on what an employer is insisting on doing, or that person's opinion. But it is possible, over a period of time,

RE: Oauth blog post

2012-08-02 Thread Glen Zorn
On Thu, 2012-08-02 at 16:58 -0400, Worley, Dale R (Dale) wrote: From: Murray S. Kucherawy [superu...@gmail.com] I think it's impossible to determine with certainty whether someone standing at the mic and asserting a position is doing so based on what an employer is insisting on doing,

Re: Oauth blog post

2012-08-02 Thread Hannes Tschofenig
In the identity management case we are not necessarily talking about solutions that are good or bad. The issue is that certain people care about one use case and other people care about other use cases. I use the term use case in a generic sense to also include certain deployment assumptions

Re: Oauth blog post

2012-08-02 Thread Hannes Tschofenig
Hi SM, On Jul 30, 2012, at 10:21 AM, SM wrote: Hi Hannes, At 12:19 PM 7/29/2012, Hannes Tschofenig wrote: The IETF allows open participation and, as such, everyone, including companies that develop enterprise software, are free to participate in the discussions. Do you think open

RE: Oauth blog post

2012-08-02 Thread Worley, Dale R (Dale)
From: Glen Zorn [glenz...@gmail.com] I suppose that that may be one reason why my experiences with corporate manipulation (or domination, if you prefer) of the IETF have been of people with those very reputations blocking good ideas that threatened the interests of their employer. It's

Re: Oauth blog post

2012-08-02 Thread Hector Santos
Whose library? (rhetorical question). In my experience, the issue is pretty straight forward and its what this OAUTH fellow exemplified - technology leaders taking control of a standard for their strategic benefit. This is not a phenomenon, its par for the course and its a principle reason

Re: Oauth blog post

2012-07-31 Thread SM
Hi Hannes, At 12:19 PM 7/29/2012, Hannes Tschofenig wrote: The IETF allows open participation and, as such, everyone, including companies that develop enterprise software, are free to participate in the discussions. Do you think open participation is wrong? It depends on what open

Re: Oauth blog post

2012-07-29 Thread Randy Bush
http://www.scifac.ru.ac.za/cspt/hoare.htm

Re: Oauth blog post

2012-07-29 Thread SM
Hi Yaron, At 05:52 AM 7/29/2012, Yaron Sheffer wrote: this blog post ( http://hueniverse.com/2012/07/oauth-2-0-and-the-road-to-hell/) by the editor of OAuth 2.0 made the rounds of the geek news outlets: Slashdot, CNet etc. I am sure many people on this list have seen it. But I have seen no

RE: Oauth blog post

2012-07-29 Thread Tschofenig, Hannes (NSN - FI/Espoo)
their valuable thoughts have not even spent the time to look at the document. Hannes Sent from my Windows Phone -Original Message- From: ext SM Sent: 7/29/2012 8:23 AM To: Yaron Sheffer; ietf@ietf.org Subject: Re: Oauth blog post Hi Yaron, At 05:52 AM 7/29/2012, Yaron Sheffer wrote: this blog

Re: Oauth blog post

2012-07-29 Thread Hannes Tschofenig
Just a minor comment on this one: On Jul 29, 2012, at 8:20 AM, SM wrote: [the] working group at the IETF started with strong web presence. But as the work dragged on (and on) past its first year, those web folks left along with every member of the original 1.0 community. The group

Re: Oauth blog post

2012-07-29 Thread Glen Zorn
On Sun, 2012-07-29 at 12:19 -0700, Hannes Tschofenig wrote: Just a minor comment on this one: On Jul 29, 2012, at 8:20 AM, SM wrote: [the] working group at the IETF started with strong web presence. But as the work dragged on (and on) past its first year, those web folks left

RE: Oauth blog post

2012-07-29 Thread Worley, Dale R (Dale)
Watching a play starting with the third act is always interesting but not informative. If there's a dispute worthy of attention by the *whole IETF membership*, could someone please summarize it (in a reasonably unbiased way) to bring the rest of us up to speed? Dale

Re: Oauth blog post

2012-07-29 Thread Hannes Tschofenig
Do you think that corporate domination of open standards development is OK? The barrier for participation is low since there are no membership fees, etc. Nevertheless, those who participate in standardization efforts have to spend their time. So, typically those who participate for a

Re: Oauth blog post

2012-07-29 Thread Hannes Tschofenig
Eran, the editor of a specification in the OAuth working group, had decided to step down from his editor-role because the group did not agree with certain design decisions (particularly with a security design decision). That happens also in other groups. Nothing uncommon so far. He then wrote

Re: Oauth blog post

2012-07-29 Thread Yoav Nir
On Jul 29, 2012, at 1:17 PM, Glen Zorn wrote: On Sun, 2012-07-29 at 12:19 -0700, Hannes Tschofenig wrote: Just a minor comment on this one: On Jul 29, 2012, at 8:20 AM, SM wrote: [the] working group at the IETF started with strong web presence. But as the work dragged on (and

Re: Oauth blog post

2012-07-29 Thread Hannes Tschofenig
Hi Yoav, Hi Like Dale, I haven't followed the play throughout the life of OAuth (the working group) Barely anyone has done that. Who are these corporations that dominate the working group? Are they content providers like Facebook, Twitter, or Disney? Are they ISPs? Is it General

Re: Oauth blog post

2012-07-29 Thread Glen Zorn
On Sun, 2012-07-29 at 23:37 +0300, Yoav Nir wrote: ... The IETF allows open participation and, as such, everyone, including companies that develop enterprise software, are free to participate in the discussions. Do you think open participation is wrong? Do you think that

RE: Oauth blog post

2012-07-29 Thread Worley, Dale R (Dale)
From: Hannes Tschofenig [hannes.tschofe...@gmx.net] Eran claims that enterprise identity management equipment manufacturer dominate the discussion. There's a common problem in the IETF that the development of a standard is dominated by companies that incorporate the standard into their

Re: Oauth blog post

2012-07-29 Thread Glen Zorn
On Sun, 2012-07-29 at 13:28 -0700, Hannes Tschofenig wrote: Do you think that corporate domination of open standards development is OK? The barrier for participation is low since there are no membership fees, etc. For participation, yes, all that is needed is an email account; if

Re: Oauth blog post

2012-07-29 Thread Yaron Sheffer
Trying to step away from the big vendors vs. users discussion... I admit I have not followed events in the oauth WG, but I did read Eran's post and his own follow-on comments, plus some others' who were burnt by our processes. Some may want to construe it as IETF bashing, but what I'm reading

Re: Oauth blog post

2012-07-29 Thread Hannes Tschofenig
I certainly agree that the participation in the face-to-face meetings is indeed more costly. For leadership positions (as you call them) such participation is indeed important. On Jul 29, 2012, at 2:02 PM, Glen Zorn wrote: On Sun, 2012-07-29 at 13:28 -0700, Hannes Tschofenig wrote: Do

Re: Oauth blog post

2012-07-29 Thread Hannes Tschofenig
It sounds indeed great to involve those communities that use the technology. However, I don't see an easy way to accomplish that when we talk about a really large community. For example, many people use TLS and they are not all in the TLS WG working group. I am not even talking about

Re: Oauth blog post

2012-07-29 Thread Tim Bray
I have not been involved in the OAuth design processes, but for the last few months, I’ve been a heavy user of production OAuth2 software. Which I felt gave me a platform to comment on the issue: http://www.tbray.org/ongoing/When/201x/2012/07/28/Oauth2-dead -Tim On Sun, Jul 29, 2012 at 2:57

RE: Oauth blog post

2012-07-29 Thread Worley, Dale R (Dale)
From: Yaron Sheffer [yaronf.i...@gmail.com] [...] but what I'm reading is three concrete statements that IETF members can respond to, and (if we accept them as true) consider how to address in the future: - A Web-focused protocol was forced to adopt enterprise use cases. [...] My first