Subject: [apps-discuss] Stephen Farrell's No Objection on draft-ietf-appsawg-authres-ptypes-registry-04: (with COMMENT)

From: "Stephen Farrell" <[email-masked]>
Date: Mon, 13 Oct 2014 02:04:29 -0700

Stephen Farrell has entered the following ballot position for
draft-ietf-appsawg-authres-ptypes-registry-04: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to http://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
http://datatracker.ietf.org/doc/draft-ietf-appsawg-authres-ptypes-registry/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

I wondered if it'd be worthwhile asking that the
designated expert try ensure that the security and privacy
consequences of new entries also be documented?  That's
assuming there are cases where the header field is likely
to transit between ADMDs. I'm not sure if that's really
needed though, but 7001 does have a fairly significant set
of security considerations, so presumably new entries
might also deserve a similar level of documentation. OTOH,
I could buy that experience with 7001 means that this
isn't really needed or that demanding that level of
documentation might be counterproductive.

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Wed, 15 Oct 2014 11:19:00 -0700

> documentation might be counterproductive.
Actually, RFC7001 doesn't talk about the risks (if any) of this header
field "leaking" outside of ADMDs that will consume it.  They should ignore
it by the rules in RFC7001, but it doesn't say how they could leak
interesting details.  That would be a useful thing to add if we ever do an
RFC7001bis.

Unfortunately, I think this is the kind of thing RFC7001 itself should talk
about, because it's a general thing to be considered and not something
specific to new ptypes.  Things referenced by this new registry are
probably the wrong place to put that responsibility.

-MSK

---

From: Stephen Farrell <[email-masked]>
Date: Wed, 15 Oct 2014 21:43:15 +0100

> probably the wrong place to put that responsibility.

Fair 'nuff.
Cheers,
S.