Re: [xacml] Summary of Discussion about Submitting XACML (and SAML)to the ITU

[Polar Humenn <polar@syr.edu>]

Hi Hal,

My opinions are interspersed below.

On Fri, 5 Sep 2003, Hal Lockhart wrote:

> [snip]

> OASIS would like feedback from the TC by roughly the end of September if
> possible. As I see it, there are two major points:
> 
> 1. Does anyone in the TC have any objections to OASIS doing this? Short of
> objections are there any questions or concerns that should be raised? If no
> one has any problem with this, I propose we pass a resolution to that effect
> at our next regular meeting on September 18th.

Not really. We have done this at the OMG, whereby the ITU endorses the 
CORBA specs, and a liaison between the OMG and ITU is maintained to keep 
the specifications updated.

> 2. The second question is more vexed. What version of XACML should be
> submitted? OASIS will most likely do whatever the TC recommends here. As I
> see it we have three choices.
> 
> a) Submit 1.0. It is complete and approved. 

I believe that we should submit 1.0, since 1.1 is not approved yet.

> Presumably the ITU can fold in the errata in some way. 

OASIS should be able to fold in the errata. The errata should only be 
things that are primarily editorial. It should be folded in and still 
called 1.0.

> This would make the approval of 2.0 a done deal. On the other hand, 1.0
> is already obsoleted by 1.1.

Submitting 1.0, would also make the approval of 1.1 a done deal with the 
ITU.

> b) Take another look at submitting 1.1 as a OASIS standard. Part of the
> reason for not submitting 1.1 was that there was no strong reason do do so.

I disagree. Version 1.1 has updated fixes and should be approved and this 
can happen much more readily than any 2.0 work.

> Perhaps this is the reason. I am pretty sure with a little effort we could
> come up with the necessary attestations, assuming the same criteria as for
> 1.0. We could do the public review and submission in parallel with the 2.0
> work. I don't expect a lot of comments. The new 20% rule is an issue, but
> Karl says this is likely to be reversed soon and in any event we will have
> to face it for 2.0.
> 
> c) Wait until we finish 2.0. The pros and cons of this are fairly obvious.

Version 2.0 is still a ways a way, much further away than 1.1. It seems
1.1 is done and ready to go. We should do that, but since that takes time, 
get the process started using 1.0 with the ITU.

> Again, I would like to get everybody's opinion with the objective of voting
> on some recommendation on Sept 18th. My opinion on this is still evolving,
> so I want to listen to what others have to say.


That's just my 27,516.59 Turkish Liras :)

Cheers,
-Polar