docs/tls.md states a security posture that is reasoned rather than field-tested:
a fault is reported and delivery continues, because a reporting channel that fails
closed is a way to blind the collector at the moment it matters. Peer-identity
mismatch is the single exception.
That posture is the least field-tested thing in the library, and it is cheap to
change during 0.x and expensive afterwards. Once integrators depend on a stream
that keeps delivering through a bad clock, changing it is a security-relevant
behaviour change.
Carried out of #650, where it was recorded as the strongest action on cutting
0.1.0 and the easiest to lose in the mechanics of tagging. The release notes carry
one sentence of it; this is the part that needs an audience and somewhere to
reply.
What to do
Put the question somewhere replies accumulate - a GitHub Discussion, or an issue
- and link it from
docs/tls.md. A page invites reading, not replying.
Two notes on how, both of which change the response rate rather than the wording:
-
Frame it as deliberate, not uncertain. The audience is engineers evaluating
during procurement. "This posture is deliberate, here is the reasoning, we
invite challenge" reads as a maintainer who has thought about it; "we are not
sure this is right" reads as immaturity. Same request, opposite impression.
-
Ask something falsifiable. "Is this the most useful contract?" gets no
answers. This gets answered by anyone who has run an ICS network:
Your device's clock is three years fast because someone tampered with the
time source, so its certificate now looks expired. Keep delivering with an
error raised, or stop?
The same treatment suits the half-supplied client credential, and whether
peer-identity mismatch really is the one case worth blocking on.
Timing
Best raised alongside whatever announcement accompanies 0.1.0 rather than on its
own - it needs an audience to reach. Not release-blocking, so no milestone.
Related
The contract itself is docs/tls.md. The divergences from it that ship in 0.1.0
are #718, #719, #731, #732, #733 and #734, all milestoned 0.2.0; what the answer
turns out to be may change what some of them should do.
docs/tls.mdstates a security posture that is reasoned rather than field-tested:a fault is reported and delivery continues, because a reporting channel that fails
closed is a way to blind the collector at the moment it matters. Peer-identity
mismatch is the single exception.
That posture is the least field-tested thing in the library, and it is cheap to
change during 0.x and expensive afterwards. Once integrators depend on a stream
that keeps delivering through a bad clock, changing it is a security-relevant
behaviour change.
Carried out of #650, where it was recorded as the strongest action on cutting
0.1.0 and the easiest to lose in the mechanics of tagging. The release notes carry
one sentence of it; this is the part that needs an audience and somewhere to
reply.
What to do
Put the question somewhere replies accumulate - a GitHub Discussion, or an issue
docs/tls.md. A page invites reading, not replying.Two notes on how, both of which change the response rate rather than the wording:
Frame it as deliberate, not uncertain. The audience is engineers evaluating
during procurement. "This posture is deliberate, here is the reasoning, we
invite challenge" reads as a maintainer who has thought about it; "we are not
sure this is right" reads as immaturity. Same request, opposite impression.
Ask something falsifiable. "Is this the most useful contract?" gets no
answers. This gets answered by anyone who has run an ICS network:
The same treatment suits the half-supplied client credential, and whether
peer-identity mismatch really is the one case worth blocking on.
Timing
Best raised alongside whatever announcement accompanies 0.1.0 rather than on its
own - it needs an audience to reach. Not release-blocking, so no milestone.
Related
The contract itself is
docs/tls.md. The divergences from it that ship in 0.1.0are #718, #719, #731, #732, #733 and #734, all milestoned 0.2.0; what the answer
turns out to be may change what some of them should do.