<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div><span></span></div><div><meta http-equiv="content-type" content="text/html; charset=utf-8"><div>Thanks Dick,</div><div id="AppleMailSignature"><br></div><div id="AppleMailSignature">The point of the secevents work was to unify all the initiatives happening under:</div><div id="AppleMailSignature">* scim provisioning</div><div id="AppleMailSignature">* RISC</div><div id="AppleMailSignature">* back channel logout</div><div id="AppleMailSignature">* oauth token revocation</div><div id="AppleMailSignature">* heart medical consent</div><div id="AppleMailSignature"><br></div><div id="AppleMailSignature">A base format and common api was the objective. If we are forking out this early there is no point to a common standard. When we started identity tokens 2 years ago the authors concern that we would end up with multiple formats and protocols looking 95% the same. </div><div id="AppleMailSignature"><br></div><div id="AppleMailSignature">So far I have heard nothing unique to RISC other than the specific events it wishes to express - which is what the expectation was. </div><div id="AppleMailSignature"><br></div><div id="AppleMailSignature">Consent seems more front and center in RISC, but again, the same is true for all the others spec groups(even the point of HEART). </div><div id="AppleMailSignature"><br></div><div id="AppleMailSignature">Phil</div><div><br>On Feb 21, 2017, at 9:41 AM, Hardt, Dick <<a href="mailto:dick@amazon.com">dick@amazon.com</a>> wrote:<br><br></div><blockquote type="cite"><div>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Title" content="">
<meta name="Keywords" content="">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:Calibri;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal;
font-family:Calibri;
color:windowtext;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:Calibri;
color:windowtext;}
span.msoIns
{mso-style-type:export-only;
mso-style-name:"";
text-decoration:underline;
color:teal;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
<div class="WordSection1">
<p class="MsoNormal">Mike: I agree it would be great for the RISC WG to focus on the data being exchanged.
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Phil: If I indicated that I was ignoring your individual contributions, that was not my intent.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">At the last F2F for the RISC WG, a number of us expressed concerns that the management model looked overly complex for what we perceived as what was required for RISC.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">While it would be convenient for RISC to use what comes out of SECEVENT, the work from SECEVENT needs to meet the requirements of RISC.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Today, I am not clear what the requirements are for RISC. I think we made progress in our discussion, but given the other thread I am having with Phil on the list, I don’t think we are all on the same page.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">While I agree with the preference to using and building upon existing standards, I don’t want to use a hammer on a screw. If we are not clear on the requirements, then how do we know that something built on SCIM will actually solve the
problem?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">/Dick<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal" style="margin-left:.5in">On 2/21/17, 9:27 AM, someone claiming to be "Openid-specs-risc on behalf of Phil Hunt (IDM)" <<a href="mailto:openid-specs-risc-bounces@lists.openid.net">openid-specs-risc-bounces@lists.openid.net</a> on behalf
of <a href="mailto:phil.hunt@oracle.com">phil.hunt@oracle.com</a>> wrote:<span style="font-size:12.0pt"><o:p></o:p></span></p>
</div>
</div>
<div>
<p class="MsoNormal" style="margin-left:.5in"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:.5in">Mike<o:p></o:p></p>
</div>
<div id="AppleMailSignature">
<p class="MsoNormal" style="margin-left:.5in"><o:p> </o:p></p>
</div>
<div id="AppleMailSignature">
<p class="MsoNormal" style="margin-left:.5in">Apologies if this sounds harsh. I want to be open and clear. <o:p></o:p></p>
</div>
<div id="AppleMailSignature">
<p class="MsoNormal" style="margin-left:.5in"><o:p> </o:p></p>
</div>
<div id="AppleMailSignature">
<p class="MsoNormal" style="margin-left:.5in">We have a draft proposal on the table. Re-using an existing protocol was the basis that Kathleen Moriarty agreed to proceed(the secevents area director). The IESG specifically wanted us to use NETCONF. Apparently,
the IETF is sensitive to the number of mgmt protocols being defined for specific purpose. The agreement with IESG to proceed was based on profiling scim which is closest to our community's stacks with many open source implementations available. Code is available
now. All that is needed is agreement on the configuration schema and people can implement and try it out. <br>
<br>
Despite all this, Dick seems to want to ignore individual contributions without debate and start fresh with no technical reason for doing so. <o:p></o:p></p>
</div>
<div id="AppleMailSignature">
<p class="MsoNormal" style="margin-left:.5in"><o:p> </o:p></p>
</div>
<div id="AppleMailSignature">
<p class="MsoNormal" style="margin-left:.5in">If we are going to design yet another protocol there needs to be a strong technical and/or legal reason to make the amount of work worthwhile. Do not underestimate what it takes to write interoperable http CRUD/Restful
specs when there as many server implementers as clients. Restful protocols are using implementer by one party. RISC and SECEVENTS is different. There are as many service providers as clients. I for one do not want want to implement a bunch of custom connectors
that are only loosely interoperable. <o:p></o:p></p>
</div>
<div id="AppleMailSignature">
<p class="MsoNormal" style="margin-left:.5in"><o:p> </o:p></p>
</div>
<div id="AppleMailSignature">
<p class="MsoNormal" style="margin-left:.5in">Best regards,<o:p></o:p></p>
</div>
<div id="AppleMailSignature">
<p class="MsoNormal" style="margin-left:.5in"><br>
Phil<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:0in;margin-right:0in;margin-bottom:12.0pt;margin-left:.5in">
<br>
On Feb 20, 2017, at 2:58 PM, Mike Jones <<a href="mailto:Michael.Jones@microsoft.com">Michael.Jones@microsoft.com</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<p class="MsoNormal" style="margin-left:.5in">I have some observations and recommendations to share from the RISC face-to-face meeting that I attended on Thursday. I’ll say up front that I believe that the mission of RISC is incredibly important, which is
why I’m taking the time to write this now.<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"> <o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in">The thing that most surprised me about the working group meeting was that none of the time was used to enable trial exchanges of incident and compromise data among the working group participants. I had expected
that to be the working group’s highest priority – especially in light of the preliminary exchanges between Google and Microsoft being so encouraging. As such, I expected that work on producing standard representations of RISC data would be foremost on the
agenda – something that didn’t occur.<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"> <o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in">Instead, my observation was that essentially all the time was spent on defining mechanisms for establishing and administering feeds of data (and defining terminology for those feeds). I would assert that this is
not where the RISC WG can add the most value. Indeed, I would suggest that the working group
<i>make a deliberate decision not to work on delivery mechanisms</i>, but instead to encourage the IETF SecEvent working group to do that work. Instead, choose to spend your time doing whatever it takes to make numerous data exchanges happen as soon as possible,
so the working group can learn from them. Heck, FTP or HTTPS are fine transports for these initial exchanges. Actual feeds aren’t needed yet.<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"> <o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in">It would be my hope that the working group can make a goal to have completed at least 20 bi-lateral RISC data exchanges involving at least 8 participants by the Internet Identity Workshop in October, 2017 – with
at least half of these exchanges using draft-standard RISC data representations. And hopefully talk about the lessons learned during IIW. That would be something to get truly excited about!<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"> <o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in">I hope that RISC will choose to focus first on Risk and Incident Sharing and Coordination and leave defining transports to others, as that is not where RISC adds the most value.<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"> <o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"> -- Mike<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"> <o:p></o:p></p>
</div>
</blockquote>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:12.0pt;font-family:"Times New Roman"">_______________________________________________<br>
Openid-specs-risc mailing list<br>
<a href="mailto:Openid-specs-risc@lists.openid.net">Openid-specs-risc@lists.openid.net</a><br>
<a href="http://lists.openid.net/mailman/listinfo/openid-specs-risc">http://lists.openid.net/mailman/listinfo/openid-specs-risc</a><o:p></o:p></span></p>
</div>
</blockquote>
</div>
</div></blockquote></div></body></html>