<div dir="ltr"><br><div class="gmail_extra"><br><br><div class="gmail_quote">On Sat, Sep 7, 2013 at 8:53 PM, Gregory Perry <span dir="ltr"><<a href="mailto:Gregory.Perry@govirtual.tv" target="_blank">Gregory.Perry@govirtual.tv</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="im">On 09/07/2013 07:52 PM, Jeffrey I. Schiller wrote:<br>
> Security fails on the Internet for three important reasons, that have<br>
> nothing to do with the IETF or the technology per-se (except for point<br>
> 3).<br>
> 1. There is little market for “the good stuff”. When people see that<br>
> they have to provide a password to login, they figure they are<br>
> safe... In general the consuming public cannot tell the<br>
> difference between “good stuff” and snake oil. So when presented<br>
> with a $100 “good” solution or a $10 bunch of snake oil, guess<br>
> what gets bought.<br>
</div>The IETF mandates the majority of the standards used on the Internet<br>
today. </blockquote><div><br></div><div>No they do not. There is W3C and OASIS both of which are larger now. And there has always been IEEE.</div><div><br></div><div>And they have no power to mandate anything. In fact one of the things I have been trying to do is to persuade people that the Canute act commanding the tides to turn is futile. People need to understand that the IETF does not have any power to mandate anything and that stakeholders will only follow standards proposals if they see a value in doing so.</div>
<div><br></div><div><br></div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> If the IETF were truly serious about authenticity and integrity<br>
and confidentiality of communications on the Internet, then there would<br>
have been interim ad-hoc link layer encryption built into SMTP<br>
communications since the end of U.S. encryption export regulations.<br></blockquote><div><br></div><div>Like STARTTLS which has been in the standards and deployed for a decade now?</div><div><br></div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
There would have been an IETF-mandated requirement for Voice over IP<br>
transport encryption, to provide a comparable set of confidentiality<br>
with VoIP communications that are inherent to traditional copper-based<br>
landline telephones. There would at the very least be ad-hoc (read<br>
non-PKI integrated) DNSSEC.<br></blockquote><div><br></div><div>What on earth is that? DNS is a directory so anything that authenticates directory attributes is going to be capable of being used as a PKI.</div><div><br></div>
<div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
And then there is this Bitcoin thing. I say this as an individual that<br>
doesn't even like Bitcoin. For the record and clearly off topic, I hate<br>
Bitcoin with a passion and I believe that the global economic crisis<br>
could be easily averted by returning to a precious metal standard with<br>
disparate local economies and currencies, all in direct competition with<br>
each other for the best possible GDP.<br></blockquote><div><br></div><div>The value of all the gold in the world ever mined is $8.2 trillion. The NASDAQ alone traded $46 trillion last Friday. </div><div><br></div><div>There are problems with bitcoin but I would worry rather more about the fact that the Feds have had no trouble at all shutting down every prior attempt at establishing a currency of that type and the fact that there is no anonymity whatsoever.</div>
<div><br></div><div><br></div><div><br></div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
So how does Bitcoin exist without the IETF? In its infancy, millions of<br>
dollars of transactions are being conducted daily via Bitcoin, and there<br>
is no IETF involved and no central public key infrastructure to validate<br>
the papers of the people trading money with each other. How do you<br>
counter this Bitcoin thing, especially given your tenure and experience<br>
at the IETF?</blockquote><div><br></div><div>Umm I would suggest that it has more to do with supply and demand and the fact that there is a large amount of economic activity that is locked out of the formal banking system (including the entire nation of Iran) that is willing to pay a significant premium for access to a secondary.</div>
<div><br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="im"><br>
</div>Nonsense. Port 25 connects to another port 25 and exchanges a public<br>
key. Then a symmetrically keyed tunnel is established. This is not a<br>
complex thing, and could have been written into the SMTP RFC decades ago.</blockquote><div><br></div><div>RFC 3702 published in 2002. </div></div><br clear="all"><div><br></div>-- <br>Website: <a href="http://hallambaker.com/">http://hallambaker.com/</a><br>
</div></div>