Re: Comments on Glossary section

["Eve L. Maler" <eve.maler@east.sun.com>]

At 05:18 PM 3/16/01 -0800, Jahan Moreh wrote:
>This my first email to the group after a week of observation.

Welcome!

>I have found that the glossary has many useful definitions. However, some
>are "legacy" and some are not directly related to the main document (though
>at some later draft these terms may be come pertinent). It is my opinion
>that a glossary should consist of terms that are either directly or
>indirectly referenced in the main document. Therefore, I believe we should
>have a final look at the glossary after the body of the document is complete
>to determine if we have all definitions are referenced (again directly or
>indirectly) in the document.

Here are my suggestions for terms to eliminate:

- All or nearly all acronyms/abbreviations that simply point to their 
expansion.  (It's probably a good idea for us to spell out all our terms 
when we use them anyway, since so many of them start with "A"...)  This 
would make the glossary a lot more compact and easy to use.  If people 
don't already know what the expansion of SSL is, they probably aren't 
qualified to read our spec. :-)

- If we really need to distinguish AAA services (and all "AAA *" terms) 
from their generic counterparts (such as a vanilla "service"), perhaps we 
can use "security" as the qualifying word -- less alphabet soup.

- I was feeling swamped by all the "access control" terms.  I would suggest 
eliminating all those that have no direct or indirect bearing on the models 
we've been discussing.  Isn't access control a subset of a type of 
authorization?

- Eliminate "classic" terms such as "attack," "firewall," "IP," and "DMZ," 
and instead point to some well-known glossary (such as those already cited 
in the references section) for them.

         Eve
--
Eve Maler                                             +1 781 442 3190
Sun Microsystems XML Technology Development  eve.maler @ east.sun.com