Subject: [apps-discuss] Applications Area Directorate Review of draft-ietf-weirds-rdap-sec-09

From: Bert Greevenbosch <[email-masked]>
Date: Wed, 22 Oct 2014 08:39:18 +0000

Document: draft-ietf-weirds-rdap-sec-09
Title: Finding the Authoritative Registration Data (RDAP) Service
Reviewer: Bert Greevenbosch
Review Date: 22 October 2014
IETF Last Call Date: 24 October 2014
IESG Telechat Date: 30 October 2014
Summary: May need an edit.

Major Issues:

None

Minor Issues:

None

Nits:

(n1) 3.3, it would be nice to replace "a 429 response code" by "a 429 (Too many Requests) response code".

REMARK: 

The draft is mainly about re-using existing security technology, rather than inventing something new for RDAP. The draft especially focuses on HTTP over TLS and possible use of X.509 certificates or password+username for authentication, as well as more advanced systems for authorisation.

In addition, the draft discusses various security choices that have to be made, and issues that need to be considered.

The draft is good reading. However, if one would like to build a secured RDAP system, the draft can only serve as a guideline, as it leaves many choices open for the specific deployment.

---

From: Andy Newton <[email-masked]>
Date: Wed, 22 Oct 2014 13:55:39 +0000

On Oct 22, 2014, at 9:46 AM, Hollenbeck, Scott <[email-masked]<mailto:[email-masked]>> wrote:

n1) 3.3, it would be nice to replace "a 429 response code" by "a 429
(Too many Requests) response code".

Thanks for the feedback, Bert. You're probably right, but since this is a nit I'd prefer to leave the text as-is to maintain consistency with other RDAP documents that describe HTTP response codes without using parenthetical text to describe the meaning of the code. We have normative references in the appropriate places to do that.

Scott,

Bert has made the same comment on using-http, so the parentheticals will appear in our other documents. I view it as a readability thing, not necessarily a normative reference issue.

-andy

---

From: "Hollenbeck, Scott" <[email-masked]>
Date: Wed, 22 Oct 2014 13:46:56 +0000

> -----Original Message-----
> From: Bert Greevenbosch [mailto:[email-masked]]
> Sent: Wednesday, October 22, 2014 4:39 AM
> To: [email-masked]; [email-masked]';
> [email-masked]
> Subject: Applications Area Directorate Review of draft-ietf-weirds-
> rdap-sec-09
> 

Scott

---

From: "Hollenbeck, Scott" <[email-masked]>
Date: Wed, 22 Oct 2014 14:03:03 +0000

From: Andy Newton [mailto:[email-masked]]
Sent: Wednesday, October 22, 2014 9:56 AM
To: Hollenbeck, Scott
Cc: Bert Greevenbosch; [email-masked]; [email-masked]; [email-masked]; [email-masked]
Subject: Re: [weirds] Applications Area Directorate Review of draft-ietf-weirds-rdap-sec-09

Scott,

[SAH] OK, well, if the other documents are going to change we should make the same change in rdap-sec.

Scott