Tomorrow's concall

Is on.  I am hoping that both Rich and Richard will be able to join this
week and so we can have further discussions on Security.  The agenda will
be as follows:

a) roll call

b) warning about new conference call number/process

c) interfaces roundtable:  anything nwe on any of the "features"

d) Security discussion

e) Do we want a call next Wednesday as I am out on the 12th??

For the Security discussion:

I would like to try and begin to reach a consensus on whether there is anything
for us to do in this area and if so what.  After the last conference call
Subbu sent the following e-mail:

I raised the following areas in today's call, but I would like
the group  to think about as well. 

  

a. My feeling is that we should let the stack implementors drive  security,
and let WSRP, an application protocol, rely on the stacks for  this support.
I would like to look it the way we looked at attachments  support. 

  

b. Interop is going to be an issue particularly since stack level  security
supports may vary in their support for standards. Although  desirable, plug-and-play
interoperability for web services security may  be harder to realize than
the current interop levels we demonstrated. 

  

c. There is also a danger of undercutting some of the security specs by  making
recommendations on what standards to use in what manner. To me  that seems
to be a slippery slope to follow. 

  

My personal view is that the game starts for us once a producer can publish
its security requirements to the consumer.  For until that happens any producer
expecting any type of security [other https which is already publishable]
will have to be "out-of-band" registered/configured by the consumer.  And
at this point we have stayed away from defining/talking about formalizing
"out-of-band" mechanisms.  As I don't see either a standard [WS-Policy] or
uniform interoperable implementations happening in the next 6 months a question
to consider is whether we merely need to wait [and do nothing], define a
simple [potentially temporary] publishing protocol in WSRP or articulate
some other value/work product to produce here related to its out-of-band
nature.

Talk to you all tomorrow.

     -Mike-