Does G071 give us enough info to trace users through the mesh of proxies, where you have multiple proxies in the mix, and you might need to trust all the proxies that are somehow connected. You will need to know who issues the statement, but also that it was not altered somewhere inbetween.
You usually follow upstream, but does that work operationally?
* do we need exercises/ Sirtfiv1 exercise showed some may be accidentally left out, like SURF then
* in a perfect world, all data is available and people react fast, but do they?
This was also discussed in the architecture meeting… but there is also good practice?
If you want any entity in the chain downstream to use these, the traceability to a community is lost?
If all entities in the chair record correctly (and share), the communication will work in case of an incident, but does that work?
* c.f. work in tracability of 3820 that Akos Frohner did
* RFC 6962 CT logging of these translations in an (external) registry. Would proxies want to do that? Encrypted?
And we need to run some ‘fake’ exercises to check if any proposed policy is possible. This does not need a real proxy or software, just a TTX with a few people thinking they are a proxy … inspired by the eduGAIN TTX from March '24.
This also implicitly validates (or not) elements of G071 …