Re: what is a threat analysis?

[Jeffrey Hutzelman <jhutz at cmu.edu>]

> -----------------------------------------------------------------------
> 2.1. Criteria for formation
>
>    When determining whether it is appropriate to create a working group,
>    the Area Director(s) and the IESG will consider several issues:
>
>     - Are the issues that the working group plans to address clear...
>
>     - Are the goals specific...

If you cannot tell us what the threat is that you are trying to address, 
and in particular if you cannot answer Russ's three questions, then the 
answer to these criteria is "no".

Anti-spam and related efforts in the IETF have a history of the answer to 
this question being "no".  That is a big part of why MARID concluded 
without reaching consensus -- the participants had never really agreed on 
what the problem was.  That same problem was evident in the first MASS BOF.

Due to this history, it is entirely reasonable for Russ to insist on making 
sure the answer is "yes" before chartering the work, since otherwise it's 
likely to be a huge waste of everyone's time.  He is free to do this in any 
way he chooses.  The approach he's chosen is pretty straightforward - he 
asked you to define the problem you are trying to solve.

Frankly, it amazes me that so many people start to do significant work 
coming up with proposals in this area without bothering to first figure out 
what they are trying to accomplish.  That's bad management practice _and_ 
bad engineering.


I would suggest that if you really want this work to go forward in the 
IETF, you should quit arguing about whether some glossary defines the term 
"threat analysis" well enough, and get on with the business of answering 
the specific questions Russ actually asked.  I expect that having coherent, 
meaningful answers to those questions will go a long way toward actually 
getting a working group chartered, and will also make the group 
considerably more effective once it is chartered.

-- Jeff

_______________________________________________
Ietf mailing list
Ietf at ietf.org
https://www1.ietf.org/mailman/listinfo/ietf