Steering Committee Notes, 9 November 2023

Administrivia

• SC nominations for 2024
• SC meeting scheduling for 2024
• REFEDS Wiki Outage - update

• Pål and Maarten's terms are ending. Pål is interested in continuing; Maarten is wrapping up. We have room for a new person.
• Would like to increase the diversity of the SC; SC has discussed candidates and will reach out to encourage nominations. Heather and Nicole will prepare the announcement to the REFEDS list opening nominations.
• There was a critical vulnerability announced and exploited. It was supposed to have been patched within 3 business days but was not. Nicole and Klaas has requested an incident report and will share the results with the SC. No data was exfiltrated as a result of the breach.

• all the votes are in; the voting system does not support closing early so it will be formally announced tomorrow.
• Alex had some minor clarification requests to the RAF.
  • 1. Many of the attribute values defined in the Framework are mixed-case. I think it would be good to add explicitly that an RP should not check the case of received attributes so that we do not have to adjudicate operational issues. As a comparison, lines 149-150 of the SAML subject identifiers specification say "Value comparison MUST be performed case-insensitively (that is, values that differ only by case are the same, and MUST refer to the same subject)."
    • ask that the WG review to make sure the correct case is used
  • 2. GR1 puts an obligation on the CSP to ensure the Claimant is the same Person throughout the process. The Framework implicitly make the same obligation on the Registrar in section 2 by stating "The person carrying out the identity proofing process for the CSP”. Is it better to state “The person or persons carrying out the identity proofing process for the CSP”. This is more pedantic than comment 1, of course.
    • this isn't part of a normative section, so one suggestion is that this be part of an addendum or FAQ. Heather will send a note to the group and indicate that this could be interpreted in different ways and ask for their thoughts on how that should be handled

REFEDS Budget and Sponsorships

• General update
• Sponsor vs Member

• One potential sponsor is having difficulty joining because of the terminology of "sponsor" vs "member". This is actually fairly common and not a problem we can solve. It will introduce more problems to refer introduce paid membership in that a membership organization is a specific type of legal entity that we are not prepared to become.
  
  • We are considered a virtual organization, which establishes some interesting issues when it comes to VAT.

• Six items currently in the work plan. SC members will update the work plan as per the discussion to clarify potential work items and clarifications for each item.

• the conversation started with the REFEDS Strategy, but now we need to consider how to use that voice. There is an increased need to lobby for our community with other spaces, including browsers, policymakers, FIM4*. We also need to do more to lobby our own leaders (e.g., CEO Forum, GEANT GA) to combat the apathy and lack of investment in the federation space. This is a lot, so we need to prioritize. Also, the R&E used to be a leading party in Internet governance, and now we have no engagement there.
  
  • SC agrees this is needed. Nicole will write up some ideas for where we might focus so we can prioritize our efforts.