4 ms·

Author of the original medium post here. I had simply never heard of COSE at the time of writing this. There was no conspiracy to bury the spec. There are a bu

by dlor 5y ago

Author of the original medium post here. I had simply never heard of COSE at the time of writing this. There was no conspiracy to bury the spec. There are a bunch of vague accusations that I'm trying to profit or rent seek off of one of the specs I did write about. I didn't create and I don't maintain any of those. I also wouldn't trust any crypto designed by myself. The original context for writing this post was discussions around using JOSE in the context of signing container images [1]. I was against it and preferred something simpler. https://github.com/notaryproject/notaryproject/pull/93 https://github.com/notaryproject/notaryproject/pull/93

leoqa 5y ago
I read both this post and yours- I didn’t see anything inflammatory and your company seems orthogonally related at best. If anything this comes across poorly for the IETF, while I understand the main point (they identify marketing/updates as a weakness) it feels like a personal rant against you.
- tptacek 5y ago
  The IETF is mostly run on mailing lists, and those mailing lists are public, so it's tough to attribute a bad take on one to the whole "organization".
  - tialaramex 5y ago
    Even more so, there is no organization. The IETF is an activity, like dancing, which humans can participate in or not as they please. You can't "join", there's nobody "in charge" and it can't believe anything.
    - tptacek 5y ago
      I knew I was setting someone up to say this. :) It's true, mostly, but it's worth knowing that different IETF working groups are, in fact, organized groups, with a set process and all the path dependency you get from any planned human enterprise. There are stakeholders in those groups that have greater and lesser influence.
    - unmole 5y ago
      > You can't "join", there's nobody "in charge" That's not entirely true. Working Group Chairs and Area Directors have significant say in what is adopted.
camgunz 5y ago
This is the same guy who cribbed MessagePack for his CBOR standard, and now it looks like he wants to jam it onto JOSE. The likely thought process here is "CBOR is MessagePack, MessagePack is binary JSON, the J in JOSE is JSON..... profit." Disclaimer: I wrote and maintain a MessagePack implementation.
- deleted 5y ago
  [deleted]

by dlor 5y ago

leoqa 5y ago

I read both this post and yours- I didn’t see anything inflammatory and your company seems orthogonally related at best. If anything this comes across poorly for the IETF, while I understand the main point (they identify marketing/updates as a weakness) it feels like a personal rant against you.

tptacek 5y ago
The IETF is mostly run on mailing lists, and those mailing lists are public, so it's tough to attribute a bad take on one to the whole "organization".
- tialaramex 5y ago
  Even more so, there is no organization. The IETF is an activity, like dancing, which humans can participate in or not as they please. You can't "join", there's nobody "in charge" and it can't believe anything.
  - tptacek 5y ago
    I knew I was setting someone up to say this. :) It's true, mostly, but it's worth knowing that different IETF working groups are, in fact, organized groups, with a set process and all the path dependency you get from any planned human enterprise. There are stakeholders in those groups that have greater and lesser influence.
  - unmole 5y ago
    > You can't "join", there's nobody "in charge" That's not entirely true. Working Group Chairs and Area Directors have significant say in what is adopted.

camgunz 5y ago

This is the same guy who cribbed MessagePack for his CBOR standard, and now it looks like he wants to jam it onto JOSE. The likely thought process here is "CBOR is MessagePack, MessagePack is binary JSON, the J in JOSE is JSON..... profit." Disclaimer: I wrote and maintain a MessagePack implementation.

deleted 5y ago
[deleted]