Internet Engineering Task Force RATS Architecture Design Team, 15 Dec 2020

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: RATS Architecture Design Team, 2020-12-15

Description

RATS Architecture Design Team, 2020-12-15

A

Hi, this is hank.

A

He said to mute michael.

B

My webex in but it's been ages since we talked yeah.

A

I I had the same feeling. Thank you likewise, my webex in this disbelief told me well you're not connected to the audio yeah so uh connect. These are your connection options tie it in no, no are you sure you want to? Yes, I want to get. Why is this so unusual for you I had to like do three or four clicks to connect. My computer audio very obstruct, and it's still showing me a call in window.

B

I don't know why yeah all of last week or the week before when I was connecting to web access, I was connected, and yet a little thing saying I'm connecting would continue to do its thing. It would just oh.

C

B

Yeah, uh and still of course, uh you know, I have a public ip, a public v4 on my desktop right, because I have I have 16 public ips in my home and um anyway, if I don't nat nat webex destinations, it won't work because their turn server is broken and, of course it doesn't work with v6 at all.

A

I use public ipv4 addresses um at my institute site and it works. Fine. Are you sure, because I am.

B

I could turn it off and try again, but but back in the spring, when I had this problem carson connected to um to bremen.

B

Yes, uh just a moment, hank.

B

Sorry, I I have a a parallel meeting uh request uh with hanus, uh but I'm joining them at the top of the hour. I just wanted to make sure that the you know it was actually going to work before they're going to have their other m2m meeting right now um there.

B

So I just suddenly had harness in my ear, and I couldn't figure out why, for a moment service, honest.

C

B

B

That would be good april fool's rfc.

B

John clenson, as a service.

A

You need a press through listen or something.

B

Yeah, that's right, but wouldn't that be good april fool's rfc, john clenson as a service.

A

I would need more context for this. I am illiterate, apparently.

B

uh Well, okay, so john clenson is a ietf old, old, timer. ah Okay, sorry yeah! I miss the pronunciation and written word is difficult, sometimes for me uh and anyway, so he's always known for his very narrow column, like 50 character, wide messages that go on for pages um and he almost always has a really good point. uh But like mark twain, he didn't have time to make it shorter.

B

Thomas saty, yes, I have an attendance list that I keep.

A

We have one thomas.

B

One thomas, so we have seven participants and I counted to seven. Okay, that's good! That's a good means that I counted people properly, because you cannot copy and paste from the participants window.

D

And yesterday I found.

B

I found during the asdf bertrand from it was impossible to copy and paste from the chat. I couldn't do it. It was ridiculous. I don't know why. um Hello all um so. I've been sharing, I'm sharing the uh uh issue list, which has gotten larger thanks to thomas and hank.

B

There's some sarcasm in that. Thank you. I think.

B

So something we're going to have to do is we're going to have to go through and we're going to have to. Each of us are going to have to take one or two issues and just figure out um what is the meaning of the issue, and if we you know, even if it is a yes, no some of them may just be. No, since we have thomas on the call, um I'm gonna suggest that we go through the issues that you opened thomas and uh we also had.

B

I think, that's what we did last time um dave. I think what did we do in the 15 minutes after you? We worked on some issue. That um was thomas, oh good. You have some other issues here from dave from 10 minutes ago.

B

So, let's start with those okay um and then we'll get to this issue here um and then we'll come back or this pull request here and then we'll come back to um issues, and maybe we can put pull some other text there. I'm happy to uh write solutions live as we go, um but I can't kind of write them on my own without uh getting, I don't say, into trouble uh there so dave. uh Let's talk about this first.

E

I I pulled uh two low-hanging fruit. It might be useful to see what the issue was. uh First, so you can verify.

D

What is impressed.

B

E

B

E

B

Tried to pick ones.

E

That were not filed by thomas since thomas was working on the stuff for his. So here we go. I'm just going.

B

To make the window a bit wider, I think we'll be better.

E

So I don't remember who this one was from, but you can see the underlying phrase. The.

B

Guy, it's a guy.

E

Gotcha, all right, so you can see freshness is a key component. Is the fourth line of the underlines there and that's the phrase. I think what you mean is that some flexibility on the requirement for freshness is the key component. Ie is the willingness to accept result? That's been around for a while enables caching ned agrees, and so I tried to incorporate roughly that words in the put.

B

Request works for me.

A

We were also working on some content that had some that require some flexibility with freshness so to speak. So I think that's actually uh very fitting.

E

B

Okay: let's do that.

E

Then yeah go and delete branch yeah thanks.

D

D

E

And check the issue number and I believe this was found by ned.

E

And his main point is: the grammar seems off to me, um although you can see in the because, for example, if you look at things like a dedicated chip, a t e or such with no commas in it in the second line there in the quote. um No, if you look at the the part in the first paragraph, look at the second line, a dedicated chip, a-t-e or such and so on with no commas. So that's an example of something that's kind of off.

E

um As you can see in his bullet list, he adds, after te a virtual machine and he replaces or such with a secure mode of operation, okay and then or other forms of domain isolation and so on, um and so here I've not incorporated his wording exactly, and so I was hoping he was going to be on, so we could compare and see if my take at that wording, I also changed the wind to an if uh there's what.

A

Is coming from yeah in the few minutes I saw this. I was not able to understand the profits of the text. I was like okay, this is too fun.

E

That way, I had a line breaks since I was changing it enough anyway. With me, it wouldn't be easy to tell um the line one one, seven three, that text is unchanged, starting from one one: seven, three, that's the line, that's the second half of the red text.

E

The first half of the red text is replaced with uh line breaks and you can see I've added a virtual machine or other secure moto operation, and I flipped the order of things such that I broke it into multiple sentences to so it wouldn't read as a run-on sentence. So please read and comment.

E

I also changed you'll notice. I also changed the phrasing to be about previously. It was about the attester located in isolated environment and I've raised it to be about a testing environment and target environment.

E

So hopefully I didn't break it, but.

A

So I I so so there's an implicit um threat here that the target environment tries to create uh generate evidence. That's a assumption coming out of the blue, I think a little bit because it's a task to do so.

F

E

Back to ned's text for a second here, meaning the issue you can see um in his I'm going to read his last sentence at the bottom of his quote here. Additionally, the tester formats, collective claims and integrity protects them with an attestation key that is also domain isolated, such that the target environment or some other entity other than the attester is not able to undermine the attesture's protections. So that was his main point here and I tried to work with that.

A

Yeah, so, okay, uh so what I would read from that uh with your text is that the target environment could have an effect on the testing environment such as that uh lies about the target environment, become possible.

B

A

The target, then five would never create evidence in the first place would be uh hard to believe that it does now uh suddenly without uh layered utilization such so. That's weird, I guess.

E

And I'm gonna read the sentence right above that, just in case you like ned's phrasing, better than mine right, where the target.

C

Environment cannot.

E

Lie or interfere with the claims collection function. That's an interesting phrasing there. I don't know if people like that, better.

A

But no, that is not better.

E

Yeah, so that's why.

A

Yeah, okay, I can't see it. I can see what you.

B

Did there now I always used to ask the question whether or not you could forge your own signature.

B

And and it's interesting because no but interesting because writing your signature is actually called forging your signature. You act, that's actually what the verb.

C

B

Right, so the point is that it has two terms in english because it means.

C

B

Make the signature is to forge your signature, but if it's not.

E

Yours, you know I forged a sword out of metal or something right. That's.

B

Exactly right exactly it's like wait: okay, but yeah. So that's the point, and it's very much is you know, k. You can't actually forge evidence about yourself. It's never actually a lie because it's whatever you believe right anyway. Yours, your phrasing is just fine. I thought you might have intended to go and make this a point, a point uh list, but I'm happy with it as commas, and I'm also happy with your oxford club.

E

Here so I I took it as uh as ned was suggesting bullets because he left it as one great big long sentence once I split the first part from the second, once I sweat into two sentences, I didn't think a bloated list was necessary.

B

That I'm I'm I'm happy with this any objections to this.

A

I can live with the uh forge evidence.

E

Meaning, if you don't have a better phrasing right, so I'm happy to accept better phrasings. But uh I I thought this was slightly better than ned's wording, which I thought was a good start. So.

B

Okay, so oops pull requests, okay, thomas, so there was one objection in this from dave already and I think I agreed to it. I agreed with your objection.

E

Or hank had the most comments I only hit. I figured we just discussed it on the call here.

B

Yeah yeah yeah, so uh I thought it was. I thought.

E

B

uh Yeah so uh and version of information of the hardware that is certainly very awkward yeah. This is.

E

B

E

Think thomas is right about this one yeah, I think thomas, is right on this one, meaning I yeah. I agree it's a change in meaning I think thomas's change is probably what was originally intended.

A

Okay, I wanted to make sure that, because it literally says that information now has versions, it can be outdated information and new information. You.

E

Know right, yeah, that's.

A

Not a point: okay,.

E

This this came from the use cases document, and so it was probably uh wordsmithing on some language that, michael, you probably originally authored, but uh yeah.

B

So even though it's not it changes the meaning, that's actually something we're saying is a good thing. Okay, so let's just resolve this. Oh that.

D

Was get that wrong.

B

uh There was an undo at one point.

E

uh That was the present versus running, and I saw this when thomas originally brought it up.

B

And I agree, let me click this resolve and then we have present versus running okay. So sorry and.

E

Here I understand thomas, your main point was software runs, hardware is the thing that is uh the the environment the software is running in and so present is more accurate, and I agree with your argument.

B

Okay, so we're agree. We agree with this change, as I think what I said so that is still resolved is what we're saying.

A

I'm okay with present, which I think is a one, won't have in any case, but it was changing, meaning and a very subtle and time integrity. Bhutan. We can really uh verify then then start or having a process here. So that's a subtle bad uh pitfall here, but if you're, okay with present I'm happy, that's actually.

E

The firmware, the other reason that I like present better, is because you could in fact sign it software you know, measure software that is not yet running. It's just present on kind of a load on demand. You can sign it as part of the evidence generation process and it isn't running until much later, and this allows for that to be the case. It's whether you do that or not.

A

E

Not important, but I think it's more flexible.

A

I think it's also much with the truth of all things. Things are conducted, so yes, yeah and.

B

And hardware isn't running it's present so right so.

A

You'll be saying.

B

It's there and you may be yeah, so, okay, so we're all okay. I think with that at this point, uh didn't ira high right.

A

Yeah, I'm not picking on on content changes where this is editorial, so I was just uh careful yeah, hey.

B

And hey: what is the change here other than.

C

Because it expands at line 202, there's for admission of the device into the network and then hank modified the the previous text. That was a networking infrastructure device with network equipment which sounds better to me.

E

I think quote: changes are fine with me, both hanks and thomases.

E

It did not put in pink's change.

E

Well, it still says a network infrastructure device instead of network.

B

Equipment I do that right.

B

I'm gonna hit reload in a second just okay, there's two commits there's the update. There's the files changed.

B

B

About the hardware and software okay, now it's got it while it's.

E

B

Yeah, okay, so resolve that.

B

Next, an assessment of system state.

E

Thomas's text looks fine to me. I changed one word and explained why, but otherwise thomas your text looks fine to me.

C

Okay works for me, yeah.

C

A

And for a non-native speaker, this is very hard to learn. I'm still learning, oh.

E

Yeah yeah, uh if you want the short version, I can explain what chicago manual style says, but then why the irc editor changes it. But uh I got annoyed at the rfc editor, keeping changing the documents that I was writing, and so I looked it up and tried to learn it myself, so that they would stop changing my stuff.

B

Makes sense what I heard is that the rfc editor successfully outsourced the job to you.

E

The island's basically right, at least for my doc, so.

B

Other examples may exist period. I love using more periods.

E

B

E

B

I I I actually, I actually find that there's a there's a stage in people's writing where they try to use as complicated in inverted sentences as possible and and it's a kind of a statement that I I'm now smart enough to make long sentences that I can't understand. um It's the god. You know removable rock wisdom. Part and years ago I was expo. I was exposed, probably chicago style as well to what was called nortel english and nortel.

B

English was supposed to be machine translatable in the 19 early 1990s to all languages, so the manuals wouldn't have to be rewritten all the time, and essentially it's always noun verb object. It's just it's never any other style. It's always that way, and it reads like you're in grade two and that's okay.

E

So this one I I like thomas's changes because the word even appeared twice, separated by three words in between and so even even um the new wording. I liked better than the even even.

B

Okay, and are you happy with and so on, hank I don't know how to I don't know how to read this plus one. The.

A

The text contained and so on- and this is gone now- that is a plus one and so.

E

On I mean oh, why.

A

E

Michael, I would insert the oxford comma, but other than that. It's fine.

A

Where's that one oh there's after memory.

B

So there is a case you can look up in the state of maine, where the absence of an officer comma resulted in um people getting milk delivery, men getting overtime on uh statutory holidays.

B

And then they changed the law to make it again such that they don't get overtime.

B

They fixed the law, but anyway went to the u.s. We went to the circuit court or something like this anyway. The device.

E

So I like hank's addition.

B

B

Illustrated reload come on reload.

B

uh There we go, okay illustrated only a boot later will interact and therefore these claims, the relevant claims, are there irrelevant claims.

B

I think it's there could be other claims that are not relevant to the bootloaders. That's, I think the point right.

B

But these work work for me too. I don't really care.

C

Yeah, I I I will not die on this, but uh it's not more a bit more precision on you know generic these, uh which were, in fact those related to the but.

E

Can you expand the intermediate the little blue thing, because I want to see the word claims in the? What is your idea?

E

uh Okay, so the word claims does not appear in that paragraph, and so when it talks about uh these claims, what is these referring to you? I think that was what time was.

B

Yeah, I think that's the issue, okay, testing, the read-only bias and have to ensure the integrity of the bootloader.

B

Maybe at some point a previous version of the text had some tech, something there that was referred back to so certainly we have to fix that anyway. Hank are you, okay, with the fact that we.

A

If we want to be precise, we have to say, therefore, claims about boot. Integrity have to be measured securely. I would just reiterate content and then it's good, because relevant doesn't really improve. The issue. I think I put stating the actual subject here does so claims about boot integrity would satisfy my concerns.

B

Relating to the bootloader or boot integrity.

F

uh Whatever you want to have here.

F

E

Backing up again! Well, if you look.

F

At what you would want to say.

E

Line 424 uses the phrase the integrity of the bootloader, so if you say claims relating to the integrity of the bootloader would be that's what I I think what these claims was referring to.

C

Is the claim related to this the measure boot, the the whole measuring chain here.

B

Well, this is not evidence. Remember these are claims, so it has a broader statement than just evidence than just the measurements. That's I think we don't define, claim.

C

B

Intended to be a bit nebulous because it applies, it refers to many things. I.

E

Mean in secure boot, when you have multiple layers right from you know, bios and boot, loader and os, or you know enclave after that, if you've got a te or whatever the same statement is true at each step right. But I think this paragraph is about the bootloader right: the integrity of the bootloader, not the integrity of subsequent stages,.

C

E

Okay, I think that if you look at the next sentence right below this line, 428- and it talks about.

B

E

At this stage of the boot cycle, right, okay,.

B

Can't compose them into evidence because we don't have a place where we can sign the evidence. Yet. Is that really the statement.

E

B

Measure we've done the measurement we've stored it into a tpm, perhaps, but but we can't turn it into evidence because that's going to happen later, while the tpm collects the rest of it together or something like that, for instance, I'd.

E

Have to look at more context, so I don't know. Okay.

C

Yes, mikey is: is that the there's? No a testing environment yet because it's not been started.

E

C

The bios is the.

E

Testing environment for the bootloader in this paragraph and the bootloader is the testing environment for the thing that it loads.

E

And the evidence is, is all that stuff put together right, and so you might my answer might be. You can't compose it into evidence, because evidence is more than just one stage right.

B

Yeah, that's the that's the point I'm trying to relate, but I said it poorly.

A

Yeah so so there is some ambiguity koi, because we don't want to overwhelm everybody with the hard facts, which is that you have multiple roots of trust, one for the measurement that started.

C

A

Of their testing environment- and that is extended here without being having a testing environment being in charge of that, so it's so has to be a secure method until you get the root of trust for reporting, yada yada- and we don't want to say all of that. So this is the simplification. Unfortunately yeah, okay,.

B

Okay, so hank is happy what about this bus connected you're happy with that? I'm happy with that sure. ah The scope of this document is scenarios. This document covers scenarios uh privately good. um I don't care according to rules that it controls according to some predefined rules, uh-oh.

B

Okay, my doorbell rang we'll see what happens if my child knows how to answer the door or not.

B

Got his black belt on the weekend big deal.

B

um You know I I'm, I think, there's a definite difference between rules that it controls and according to some predefined rules, which.

E

Section right now is this: at the end in security considerations, or is this at the beginning in.

B

E

Okay, this is the definition of the the relying party uh role- okay, meaning this is.

B

About applying personal, it's okay.

E

To be more verbose than one of their sites,.

B

Yeah, okay and then we have this other. This is ending personally identifiable information.

B

The verifier might share this information with other authorized parties.

C

According to relative controls, it doesn't seem correct right. It's not a very that controls the rules that define the way in which pii are.

B

Well, it it. The verifier follows some rules, and it it it it. I mean.

E

B

E

Hank's freezing, although you can see it, takes suggestion at the bottom, um pii is taken as an acronym or it's not in the parenthesized form after it appears like four lines before, and so his is fine if we had the parentheses pii after that, after 8 28..

E

C

Or expanding it in the.

F

E

Of hank, so whichever I don't care.

A

Yeah, actually I assumed somehow this was already introduced, but apparently it wasn't so I'm sorry well.

B

I I I you know. I actually think that I.

E

If some people just call it pii without knowing what it stands for, so I think having both is good well.

B

Well, yeah, and I also think that sometimes, if you haven't spoken about something for a while, it's useful to repeat the the definition so that, because not everyone like, like the first time I saw pii, I went what the and I had no idea what it meant. um So, if you haven't been working in that field, I would say that it it's a surprising thing for many people. So are you okay with this? Then this point I don't know if my suggestion really got in, I don't know if it did. Maybe here.

E

Refreshes to check but yeah, okay, now it's there.

B

Oh, it's there.

B

B

G

um Why are the rules predefined.

B

Yeah, let's get to there because.

E

The verifier has to have uh knowledge enough to deal with it at runtime. I think that's the only meaning of predefined meaning before it needs to know.

D

Why not just say something like governing policy.

G

That sounds better to.

G

D

H

You could pre-define the rules a microsecond before right. That's.

G

Yeah, that's the, but that's not the spirit of pre-defined and pre-defined. As usual.

A

Governing sounds fine.

B

Okay, okay, so you want to change that again.

E

um Actually, didn't you already merge in hank's and hasn't refreshed, so you have to refresh before you modify something otherwise you'll hit a conflict.

B

Yeah you're right.

E

B

Now you can modify.

E

It through he defines.

B

There's address the handling of pii. Here we go, yes! Is that that our I mean.

E

So the suggestion was just change. The words predefined rules to governing policy was the suggestion on the table.

D

Yeah, if you just say pii, that's too limiting there might be some other um factor that that impacts, the policy that we control, sharing, such as.

B

We're specifically.

H

B

Pii here there could be other.

H

Ways you're talking about.

A

B

A

We're talking pii yeah go ahead, think we are talking about sensitive information such as pii, so it's an example- and I think that's correct. So if we're going back to this, it's also an example in the final sentence.

E

ah Okay, so hank, your point is, you know, is an example, because it's such as an 8 28, and so we can also say to address the handling of sensitive information and not use the term pii.

A

Exactly I don't.

E

See that and that's a very good point so then michael, I would revert your change to 829 to remove parentheses, pi and change just pii in here to say sensitive information in the edit that you're doing right now.

B

So, first of all, I'm here, so this is going to say handling of sensitive information. You.

E

Can still keep all the parentheses part, the size part yeah sense of sensitive information, so it matches the phrase in 828. Okay, now that you've done that we no longer need to add the parentheses pii back in 829.

B

I don't mind leaving that.

E

I I don't care either way so.

B

I I I like this for two reasons. One is that if someone searches the document for pii, because they want to know how we're dealing with it, you know it's- it's alissa cooper comes along and wants to know. If we dealt with this, I'm just going to search for that point. Yeah it's going to find that it's going to be there, it's going to say something useful about it, so I'd rather leave that both there okay for now.

C

Mike it's already in in the previously consideration section, though, okay yeah.

B

I I I still don't mind because of the search point someone.

C

B

For pii, I don't mind and, as I said, that term is not. The term is not well understood among every group of people, people who know it know it well, and the people who don't know it don't know it at all is what I would say uh so.

D

I I think that pii is too limiting, I mean, there's lots of times. You wouldn't want information to be shared because.

E

It'll, let you.

D

Fingerprint the machine.

E

Sensitive information.

B

So we did change this part here. It says sensitive information now pi is such as pii, but it's not the only case. Does that make sense to uh peter.

D

Well, I mean, does it actually say it's not the only thing I mean it implies that it is but yeah.

B

D

B

D

As so, I I think I would like it better if you uh take a add something: that's not personal, because system identification is an issue as well right because, if you're an attacker and you can get access to something that the verifier is sharing and so from a policy point of view, you might want to specify that that is not identifying.

B

You would like us to say such as personally identifiable information or.

D

And then you want to identify of information or something along the line, because I think that's that's really an issue as well. I mean lots of systems, don't deal with pii, but you don't want the verifier sharing information about an attestation.

D

So I'm identifying.

C

Very happy with the idea that there's.

D

A governing policy um saying whether you can or cannot do that, um but I think it's just clear that it's way more, you.

E

Don't need the comments, you don't need the comment when there's only two, I don't think I mean I think it's short.

D

E

That you don't hope we don't need the.

D

Other is not they're not appropriate, because pii is not system identifiable.

B

Information, uh there are many people that feel differently, but I don't mind writing what you say.

E

um Pii can be in system identifiable start to become cenimous when you start to have personal devices like a fitbit or something.

D

E

But it's okay to remove it.

G

And the, but the sensitive information here is more than just um identity kind of things. It could also be things that are used to attack the system like.

E

G

D

Set is present, for instance, would be a example of sensitive information that shouldn't be shared.

E

Yeah, if you can figure out exactly.

D

Which password.

B

You can look.

E

For which things are not fixed in that patch set yeah so.

B

That's why I put the comm in there because I figured there was going to be something else in there. So what? How would you like to phrase that the the patch version that's.

E

B

E

Of system identifiable information, I don't think you need to call that out unless somebody else I.

B

B

Yeah, that's what I heard is that people wanted to call that out. No.

E

I brought it up as an example of system identifying little information. That's not pai. It's just sensitive information. I'm explaining why I think it could be sensitive in some contexts.

B

Is there some other wording that someone would like to put in here.

E

Is that good enough for you, peter.

D

uh Yeah, that's fine. I think uh certainly captures my my point.

B

B

Okay, a governing policy that addresses the handling of sensitive information, potentially included in appraisal policies for evidence. Okay, going on, we have in some cases where evidence contains.

B

Sensors, when evidence contains censoring a tester.

E

Hey I'm okay with that is the first phrase up to the combo. What's the rest, I gotta read people's comments here.

B

uh Can I close that somehow without resolving it, I don't see a way to.

E

Collapse, it yeah. I don't.

B

Know collapse it. um Okay, sorry well I'll go down, and if you want me to go back up again, maybe I can just slide it onto there.

E

Your only other choice is to reduce the font.

E

B

I don't think I mean I can just make the window bigger. Then the font size will be smaller on your.

B

B

I think that's a reasonable rewrite.

A

Yeah I'm doing the picking here. So uh I'm fine.

E

Okay, I've read, although you mean the green looks fine, can you scroll up so I can read the red one more time just to make sure it's not a point. That's not captured okay, yeah, I'm fine with the green text.

B

Hank, you had a comment here, but I'm not sure if your comment was positive or negative. So.

A

The first sentence says that again changes the meaning yeah I mean it was not the initial intent of the text. I don't know what the text said before is not saying it anymore. That's the only thing I highlight in the first sentence and the sensitive stuff is just the picking, so they can ignore that basically, but um but uh before it said sometimes this happens.

B

And not at all, and now it's.

A

Always it's a difference typically,.

B

Requires yeah yeah.

A

Sorry, yeah, sorry and return. My comment uh thomas fixed, that yeah.

E

Well before I was actually doubly um hand wavy, because it said in some cases it might right, and so it was already kvued with in some cases and then it might after that, and so you didn't need both of those, and so it replaced both of those with typically, which I think is okay.

B

This is fine. Well, I would say the other thing is instead of typically, we could put. May.

E

Well, it still has the might at the end of at the end of the line, 836 right and might even.

B

Might yeah all right? Oh.

E

That's why I find it.

B

All right, I'm fine, too yeah. Okay, so resolve uh grammar.

B

E

E

um And I had to go back and reread the definition of attestation results, um but I think uh thomas's phrasing is okay.

E

I don't understand the difference yet between thomas's and hanks, meaning I understand the difference in the words I don't know, if there's a difference in meaning that hank had in mind.

B

I think this has to be a boolean value, single, singular.

E

Well, I think I understand hank did it because attestation results is plural, oh, and so you could say.

B

An attestation.

E

Result but yeah, that's actually the first complaint that I had with hanks and I went back and said. Okay, I see why I did that, but given that you just had exactly the same reaction as I did, um that means.

B

E

Probably confusing to keep it plural, I notice.

B

I think it should be said via a bowling value. Well,.

E

That's what thomas did.

B

Yeah, a vote bowling.

E

And so the difference is that thomas used, carrie and hank may had uh be expressed via.

A

In the end, I would be okay with carrie, so that's the the the problem I had was actually like.

B

We're okay, with expressed it's the it's, the pluralization of boolean or.

E

B

That's bothering us, I.

E

Understand that I just I don't know if this is, if there's a meeting difference between carry and be expressed by, I think the the b to carry change is fine, because if we go back to the attestation results, it's a something like a signed set of. uh You know, claims right and so uh be a boolean means it's just a set of claims, or it's just a claim right. It doesn't talk about the signed part, so I think it's correct to change the b to carry, because that's the cut.

A

So what I try to do here is because we have two: we are comparing two things and two things now start with via it's higher boolean values or richer things and or via. So that's, the repetitiveness shows the two things easier to a reader.

A

That's the only thing I did here effectively, the the the.

G

Important point about boolean value is that it really could just be one claim that is a bullying audio. That says yes, attestation was, it was a success. That was the point of that.

A

D

It could be, I I think, boolean values is correct, so think about the the trust, vectors kind of idea, what you're? What you're getting is a vector of boolean values, um and there are plenty of scenarios that also want to have uh evidence that are that have been expressed or retained in richer claims. So I know at least one system that was interested in keeping history of things, and they wanted more than just it passed at this time. They wanted to know specific things about uh the history of that system.

E

Well, that's already accommodated by that richer set of claims in the yes.

D

Right, I'm saying that that I think you need both ideas, that uh they're.

E

D

Right so I I I thought I heard some suggestions to get rid of that.

E

No you're talking about whether or not you're into this one into this chocolate is where there's only one boolean value the other end of the spectrum.

G

Is a whole bunch of information.

E

To simply pass or.

G

E

I don't like that as much as that. How much is freezing.

E

Right now, the the I think right now I like thomas, is phrasing better than the other ones. I understand hank's vietnamese objections to the via part, but I like thomas's phrasing on the uh a boolean value and uh richer. So I like those this.

B

Is how I would write it? A boolean.

E

B

Okay, that's the simple thing or a richer set of claims right, which then could be many boolean values or whatever. But the important part is that it's except it's our architecture accepts the possibility that it's you just get a yes or no.

E

So the more I think about this, the more I like carrie, better than via for the same reason as I like carry better than v and yes to your wording. Michael I'm. Fine with your wording, I'm just back to the word via, but otherwise, maybe not maybe make harry now be carried means something absolutely otherwise. The other way around it taps may carry or include, I think, is the term using the definition, which is synonymous with carrot. You could use. The word include, but uh but kerry I think, is fine. Sorry do.

H

You want to or include or.

E

No, no! No, but now the second carry, I think in the second, via I think, hank's point was he wanted to match to work and so or may carry.

E

And I don't know if that helps uh hinkling wanting them to match the rewritability.

E

Via to me sounds much closer to b, and the point is the attestation results is defined as the signed part of the claims, not just the claims itself.

F

Just a set of claims.

A

Another station results.

F

A

Okay, with both carry is as long as it's comparable and it's this now and singular. That's fine! I'm good with this.

B

All right, so I'm gonna just.

E

Yep, it sounds good.

B

In the list, okay, I hate all these little little commits I'll, say the same thing, because we don't put something paper in it: okay, chip with a comma that sounds wonderful. Another comma, inserted.

E

uh Wait: wait. You stay go back to the comma insertion for a second.

E

ah Okay, that comma, okay.

B

Yeah we need another column.

E

Stop it? No! No! No, it doesn't matter it doesn't matter because it's going to be a conflict anyway, that's what we just merged. That was the the ned change that I did. The ned issue that I changed right, so you'll hit a merge conflict on six 1169.. Okay. So actually, if you delete the comma change here, you can probably make this go through without the merge conflict.

E

It was unchanged and it won't touch the text of the one touch and it will just work that comma was good. I I.

B

Know what you're saying I'm just trying to think about this? It is.

E

Into the first line,.

B

Chip here, yeah.

E

Not that the change isn't correct, just that it's already merged into master, so.

B

uh I don't think it'll matter, I think we'll get a conflict, because uh the underlying change is there.

E

B

We have another comma inserted here.

E

um I did that in my suggested change. Sorry, you can see he added reference values. Hank said.

F

E

Catch I added a comma after reference values.

B

E

And thomas himself.

B

Why do you no longer thank yourself, thomas.

C

Because uh uh because there's another instance of my name somewhere else, so oh.

B

Because I put you in the uh I put you in the uh the um yeah, he got double thanks. Maybe because I was trying to use the acknowledgement mechanism uh like there's a you. Can it.

C

B

It in it acknowledges you in an xml way: that's straight. That's better, more easily uh tracked gotcha uh there! So, okay! So let me see here so to do this now, I'm probably.

E

You first have to commit the changes you just added the batch.

B

Where's the credit changes.

B

Button commit suggestions.

B

Yeah you're right, the diff is.

B

Outdated, oh now, we have to put them back into the.

E

B

Wait wait, wait, wait.

E

That wasn't the only one.

B

Add suggestion to batch.

E

Yep and you had one more someplace, because there was three before.

D

Three: okay.

E

Now you're good.

B

I have to go by the way, a minute or two before the top of the hour.

B

Not that you can't continue without me.

B

B

Would people be okay with having uh one or two issues and has conflicts with the base branch? No.

E

Conflicts emerge, oh.

B

No conflict so.

E

That's right now that you remove that comment. It says you can merge.

B

You think I have no comments all right. Well, uh I don't always believe you, but there we go okay, so uh 55 open issues. So what I would like.

E

Is so I know michael you're going to drop off momentarily um I've actually started on vacation starting now, so I want to make sure. uh Can we not meet the rest of the month, even though we got lots of issues.

B

E

Vacation time is that, okay with people yeah, okay,.

B

uh So I will you.

D

Tend to ask before you drop so.

B

E

Next week, um thomas, how many of the ones that we just merged are covered in these issues here, because I don't think it had a you know a fixes comment. So iron is there any of these. They should not be closed. No, no, no okay,.

B

Okay, so so dave uh on that topic to january 5th,.

B

January 5th, we're going to continue again is what I hear you're saying.

E

um I think it's okay- I I may still be on vacation that day, but it's close enough so yeah I mean I don't know if I'm gonna be on vacation. That day depends on which day I start back, whether it's monday, tuesday or wednesday, that week.

B

uh I guess that's somebody's system responding to my email, maybe um uh so what I would like to do is I would like to throw one or two issues at everyone on the call who's willing or have you take them.

E

B

Can nominate the issues you can pick them? What I guess what I would like to do. I would rather, if you work on an issue you care about, so I would. Rather you grab the issues you care about, so what I propose is that I'm just going to throw an issue at or two at I know who's on the call today uh like later on today, if I haven't seen you grab an issue, does that seem fair?

B

So what I want you to do is basically to read it understand it enough. One of the options you may say is I don't. I don't agree with this this point. I don't think we should do anything um or, ideally, you would produce a pull request, but um I would understand if that is more than some people can do uh and or just throw text that you think belongs into the issue and will turn into a pull request. As a group.

E

Or minimally at least edge your own comments into the issue itself, because I know uh peter you had an issue with being able to generate pull requests, but I understand you can generate comments and issues right.

B

Yeah, that's what I meant is that if you can't actually generate a pull request, then say well, I think the text should maybe say something like this right.

E

Or you agree with the point, but it needs to be wordsmith or no you're missing an important point here. You need to you need to cover. You know, x, y or z,.

B

Or it's stupid and we should just won't fix it.

D

Yeah, a lot of my problems have to do with uh writing written uh uh comments, uh as opposed to verbal.

B

D

B

B

Peter, if you want to simply make a note to yourself and tell us the comment at the next call, that would also work. Okay,.

D

If you can do that, I mean uh sure I think I'm gonna be unavailable mostly until january, but.

E

D

E

Yeah, I'm not planning on doing anything before uh like january. Third, so.

B

D

E

Then it might be january.

D

If I, if I get an issue, I will do my best to uh make sure comments get back to someone who can make them.

B

um So so it also sounds to me like based upon the pace that we're going at, that it's going to take us about four meetings to get through these, um and so that means most of january. Is that that seem? Okay, um I I. I think that probably half of these issues are probably meh.

B

You know that's a nice point, but what are we gonna do about it right, yeah um and that's? Okay. We don't have to respond to every single thing. That's said out there.

E

Yeah because keep in mind that some of these uh issues could be addressed with an email response until the one we're using the won't fix label for the ones we've already agreed are in that category, and there are also some things that we may have already fixed, not that the filing was wrong, but it may have been filing just as a question or something like that. Does it really mean this, and if the answer is yes right, there's no reason to change the text. The answer is just to respond in email, so.

B

So there were four or five of the doesn't really mean this- that I actually didn't even turn into an issue yeah, but okay yeah totally. So please, if you can grab a couple issues that look interesting to you and uh I'm gonna go and throw a bunch at people and if you don't have a guess, I guess the one one solution is: if you don't have a github login, then I won't know how to do it and I won't be able to give you an issue. But um how do we grab?

B

Oh, so you could go in. You could pick this and then you could click on this button assigned to yourself.

G

E

Seem to have that button.

B

E

Have to be marked in this organization as a contributor or I'm.

B

Surprised lawrence is not but um okay like because I thought that I've yeah.

E

It's there or incessant unblamed right, yeah.

B

Well, we'll you you can, you can also just type you can also probably type here lawrence assign it to yourself and then I'll know it's assigned to you. If I can't click on that button.

H

B

B

All right, fair enough, uh I'm going to drop off and go to this other call and um I'll talk. um Merry christmas and happy hanukkah and all those other things to you guys and thanks for a really good year of really hard work.

H

Yep, thank you mike. Thank you, bye-bye guys, bye-bye take care.

H

H