https://datatracker.ietf.org/wg/scitt/meetings/
", "time": "2023-01-30T16:05:38Z"}, {"author": "Joshua Lock", "text": "I see agenda and materials links but not the meetecho link
", "time": "2023-01-30T16:06:28Z"}, {"author": "Joshua Lock", "text": "got it :embarrassed:
", "time": "2023-01-30T16:07:56Z"}, {"author": "Hannes Tschofenig", "text": "The meeting link is in the calendar invite. Click on the session materials.
", "time": "2023-01-30T16:10:10Z"}, {"author": "Yogesh Deshpande", "text": "Hannes, can you please provide share permission
", "time": "2023-01-30T16:10:12Z"}, {"author": "Hannes Tschofenig", "text": "I guess I will just send it around every time because it is hard to find
", "time": "2023-01-30T16:10:40Z"}, {"author": "Brian Knight", "text": "https://github.com/ietf-scitt/draft-birkholz-scitt-software-supply-chain-use-cases/pull/18/files
", "time": "2023-01-30T16:14:07Z"}, {"author": "Roy Williams", "text": "We can hear Dick and Yogesh. Yogesh can you not hear Dick?
", "time": "2023-01-30T16:15:06Z"}, {"author": "Roy Williams", "text": "Dick the question is are the three roles for the discussion
", "time": "2023-01-30T16:15:20Z"}, {"author": "Michael Prorock", "text": "+1 3 roles for basic use case doc makes sense
", "time": "2023-01-30T16:18:27Z"}, {"author": "Michael Prorock", "text": "use case doc should outline the use cases, and should avoid touching on solutions
", "time": "2023-01-30T16:20:49Z"}, {"author": "Monty Wiseman", "text": "I've been called into a meeting. I'll be traveling on business next week so will not back on Feb 13
", "time": "2023-01-30T16:22:10Z"}, {"author": "Henk Birkholz", "text": "if a supllier is the auditor, it auto-magically becomes a self-asserter
", "time": "2023-01-30T16:23:44Z"}, {"author": "Henk Birkholz", "text": "as Neal said
", "time": "2023-01-30T16:23:51Z"}, {"author": "Henk Birkholz", "text": "\"stating an opinion\"
", "time": "2023-01-30T16:24:03Z"}, {"author": "Kay Williams", "text": "+1 Neal. Supplier make a statement of authorship; Auditor makes other statements (e.g. software meets a set of requirements)
", "time": "2023-01-30T16:24:45Z"}, {"author": "Henk Birkholz", "text": "trusted 3rd parties (according to NIST) create these \"3rd party attestations\", which are in IETF typically referred to as \"Endorsements\"
", "time": "2023-01-30T16:24:59Z"}, {"author": "Michael Prorock", "text": "related to this use case directly https://www.theregister.com/2023/01/30/opinion_eu_foss_security/
", "time": "2023-01-30T16:26:12Z"}, {"author": "Michael Prorock", "text": "queueing to speak to supplier self attestation
", "time": "2023-01-30T16:27:09Z"}, {"author": "Henk Birkholz", "text": "Charlie is right! I made an oversimpleifiaction
", "time": "2023-01-30T16:27:15Z"}, {"author": "Joshua Lock", "text": "apologies all, I have a conflict and have to drop early. Will keep up with this discussion on the list.
", "time": "2023-01-30T16:30:34Z"}, {"author": "Roy Williams", "text": "Michael, your volume starts out low.
", "time": "2023-01-30T16:33:40Z"}, {"author": "Michael Prorock", "text": "Thanks Roy
", "time": "2023-01-30T16:34:38Z"}, {"author": "Orie Steele", "text": "We did cover some of the FIPS scenario at the last IETF
", "time": "2023-01-30T16:34:46Z"}, {"author": "Orie Steele", "text": "In the examples / stories from the hackathon
", "time": "2023-01-30T16:34:55Z"}, {"author": "Orie Steele", "text": "I'd love to see more unpacking of those use cases.
", "time": "2023-01-30T16:35:18Z"}, {"author": "Michael Prorock", "text": "+1 Orie
", "time": "2023-01-30T16:35:39Z"}, {"author": "Henk Birkholz", "text": "@Neal, good point. Would you propose the \"delegation\" vs. \"signing authority\" on the list?
", "time": "2023-01-30T16:36:24Z"}, {"author": "Henk Birkholz", "text": "+1 Orie
", "time": "2023-01-30T16:36:40Z"}, {"author": "Orie Steele", "text": "People can \"sign anything they have\"... but there is often no reason to trust an issuer to make claims about subjects they have not authority over.
", "time": "2023-01-30T16:39:19Z"}, {"author": "Henk Birkholz", "text": "+1 Hannes, it is about what
\n1.) who signed
\n2.) what information is added by that
\n3.) is that entity authorized by a supply chain party
\nbut that also already delves into solution space - we need generic use cases and have to take care that they are mostly in the sweet-spot between being solution/use case and specific/generic
+1 Dick, roles and entities separation
", "time": "2023-01-30T16:40:01Z"}, {"author": "Michael Prorock", "text": "have to drop in 5 - really appreciate the conversation and forward movement
", "time": "2023-01-30T16:40:22Z"}, {"author": "Orie Steele", "text": "^ yes, roles are useful, and same entity often plays multiple roles at different stages of a supply chain.
", "time": "2023-01-30T16:40:28Z"}, {"author": "Henk Birkholz", "text": "@Orie: role + role \u2260 new role, entities are the \"aggregator\" for roles
", "time": "2023-01-30T16:41:28Z"}, {"author": "Henk Birkholz", "text": "@Orie: I think that was a +1 :-)
", "time": "2023-01-30T16:42:22Z"}, {"author": "Orie Steele", "text": "<3 yes, thats what i meant.
", "time": "2023-01-30T16:43:50Z"}, {"author": "Orie Steele", "text": "+1 Jon, great use case regarding FIPs and Hardware.
", "time": "2023-01-30T16:44:56Z"}, {"author": "Kay Williams", "text": "Need to drop. Henk and Yogesh, thanks for your work on the use cases. I reviewed.
", "time": "2023-01-30T16:46:47Z"}, {"author": "Jon Geater", "text": "+1 for signing only for yourself
", "time": "2023-01-30T16:50:49Z"}, {"author": "Jon Geater", "text": "Attestations are witness statements. They take responsibility for a claim
", "time": "2023-01-30T16:51:06Z"}, {"author": "Roy Williams", "text": "Producer's do not have complete control of who\\what makes additional claims on their product. Antimalware companies will produce evidence and \"my\" company will make an endorsement as to whether or not their employees CAN use that product.
", "time": "2023-01-30T16:54:16Z"}, {"author": "Roy Williams", "text": "The producer does not control that statement.
", "time": "2023-01-30T16:54:26Z"}, {"author": "Roy Williams", "text": "There is an RBAC role of the producer though that they in the future can expire their product. External claims by competitors should must be precluded from that.
", "time": "2023-01-30T16:55:55Z"}, {"author": "Roy Williams", "text": "Summary. Read read the use case and post comments.
", "time": "2023-01-30T16:56:40Z"}, {"author": "Roy Williams", "text": "Have to head out. Thanks everyone.
", "time": "2023-01-30T16:56:48Z"}, {"author": "Henk Birkholz", "text": "there seems to be a poplular candidate for policy laguage
", "time": "2023-01-30T16:58:39Z"}, {"author": "Raymond Lutz", "text": "The term \"signing\" is overloaded, and if we separate the meaning then this will resolve this I think.
", "time": "2023-01-30T17:02:39Z"}]