Subject: USEPRO document on IESG processing queue

From: Harald Alvestrand <[email-masked]>
Date: Wed, 11 Mar 2009 13:00:14 +0100

Lisa has scheduled the USEPRO document for IESG discussion on April 2.
Let's hope this is the end of this work.

             Harald Alvestrand

---

From: Lisa Dusseault <[email-masked]>
Date: Wed, 11 Mar 2009 12:59:04 -0700

Actually, it's on the IESG's agenda for tomorrow!

Lisa

---

From: "Charles Lindsey" <[email-masked]>
Date: Thu, 12 Mar 2009 11:24:42 GMT

>Let's hope this is the end of this work.

But this is NOT yet the end of this work, since we still have not resolved
Issue 1586.

The last contribution on this was from Russ on Feb 1st
<http://www.imc.org/ietf-usefor/mail-archive/msg04517.html>, the relevant
part of which is:

>I think our options here are:
>
>1. Treat the Path header as special and permit (or even encourage)
>   retaining it while not permitting retention of the other trace headers,
>   on the grounds that it has an intrinsic ordering and therefore isn't as
>   prone to confusion as having multiple trace headers that aren't
>   ordered.
>
>2. Leave the existing wording, which requires multiple injection to remove
>   or rename the Path header but allows readers to add spurious POSTED
>   <diag-keyword>s by violating a SHOULD.  I'm not entirely comfortable
>   with it, but I can't think of any specific protocol harm it could
>   cause.
>
>3. Restore the MUST in the proto-article section to match the MUST in
>   3.4.2 and make the document consistent but possibly too strict.
>
>4. Relax the MUST generally in 3.4.2, but then we will run into issues
>   with Injection-Info, which the posting agent is not permitted to supply
>   and which doesn't have an intrinsic ordering the way that the Path
>   header does.
>
>The more I think about it, the more option 1 seems like a workable idea,
>but I think that's reversing some decisions that we made some time back.
>That makes me nervous at this stage of the process.

I replied to that agreeing that option 1 was the best way to proceed, so
that leaves Russ and myself in agreement.

The only other view expressed was yourself a couple of days before that
expressing some doubt concerning the possible advantage "script kiddies"
might take if we permitted multiple "POSTED"s to remain in Paths. I am of
the view that there are pros and cons to that approach, but am of the
opinion that on balance it is better to allow them.

I would be willing to provide detailed wording suggestions, but would
prefer that we reach agreement in principle first that option 1 is the way
we want to go.

BTW, it seemed that Russ had comitted changes prior to publishing a
further draft, but I have seen no sign of such a draft - an in particular
no notice of it has appeared here.

-- 
Charles H. Lindsey ---------At Home, doing my own thing------------------------
Tel: +44 161 436 6131            Web: http://www.cs.man.ac.uk/~chl
Email: [email-masked]      Snail: 5 Clerewood Ave, CHEADLE, SK8 3JU, U.K.
PGP: 2C15F1A9      Fingerprint: 73 6D C2 51 93 A0 01 E7 65 E8 64 7E 14 A4 AB A5

---

From: Russ Allbery <[email-masked]>
Date: Thu, 12 Mar 2009 12:48:43 -0700

"Charles Lindsey" <[email-masked]> writes:

> further draft, but I have seen no sign of such a draft - an in
> particular no notice of it has appeared here.

http://www.imc.org/ietf-usefor/mail-archive/msg04543.html

I'm not sure why you wouldn't have received it.  (There were no changes
related to #1586 in it relative to -13.)

-- 
Russ Allbery ([email-masked])             <http://www.eyrie.org/~eagle/>

---

From: Lisa Dusseault <[email-masked]>
Date: Thu, 12 Mar 2009 14:02:16 -0700

Hi Charles,

USEFOR is done as a WG.  I checked this with the chairs, and the
energy to try to make any further improvements or clarifications is
just not there.  The issues are sufficiently dealt with.  The IESG
reviewed the document and decided it was a sufficient improvement on
the previous RFC to be worth approving.  In many ways this is a job
well done despite the slowness of closing bunch of issues.

Thank-you for your efforts in helping us get to this finishing point.
Lisa

---

From: Harald Alvestrand <[email-masked]>
Date: Fri, 13 Mar 2009 16:59:42 +0100

> <http://www.imc.org/ietf-usefor/mail-archive/msg04517.html>, the relevant
That's wrong.

The last contribution on this issue number is on February 4, from yourself:

> In <[email-masked]> Harald Alvestrand <[email-masked]> writes:
>
>   
>> >Charles Lindsey wrote:
>>     
>>> >>
>>> >>    NOTE: Whereas the presence of two "POSTED" <diag-keyword>s will often
>>> >>    indicate a malicious attempt to disguise the true origin of an article,
>>> >>    it could also arise following some ususual gatewaying or injecting
>>> >>    scenario (taking advantage of the "MAY contain" above), in which case
>>> >>    it could be useful for detecting unintended loops or mismanaged
>>> >>    gateways. The whole intent of these <path-diagnostic)s is to assist
>>> >>    humans in assessing unusual situations, and it would be unwise for
>>> >>    subsequent agents automatically to assume one possibility or the other.
>>> >>
>>>       
>
>   
>> >I disagree with this idea, and think we should keep the SHOULD NOT.
>>     
>
>   
>> >Not throwing away information can be accomplished by tricks like 
>> >Old-Path:. As the proposed note effectively says, saying that multiple 
>> >POSTs are generally acceptable is an invitation to the script kiddies to 
>> >play with it.
>>     
>
> If the script kiddies try it, they will get caught out because two POSTEDs
> will then be present and any suspicion of trollery will be confirmed.
>
> But in the case of some carefully crafted Gatewaying scheme, or, worse, in
> the case of some broken Gatewaying scheme that ought to be spotted,
> destroying the evidence will do harm. And I doubt people will want to
> bother with Old-Post hacks.
>
> There are plenty of Netkops around who will gleefully denounce the trolls,
> and plenty of experienced newsadmins who will notice indications of broken
> Gatewaying (especially if consistently repeated) and quietly warn those
> causing it.
Russ and I did not agree with your proposal. Given that only 3 people 
commented at that time, I saw absolutely no reason to hold up finishing 
the USEPRO document while waiting for more people to come on board with 
opinions.

rt.psg.com is down today, so I can't verify whether I actually closed 
the issue. But I see no need to reopen it.

                   Harald

---

From: "Charles Lindsey" <[email-masked]>
Date: Fri, 13 Mar 2009 18:04:53 -0000

> The last contribution on this issue number is on February 4, from  

True, but that was mainly a +1 to what Russ was suggesting, with little  
additional comment.

> commented at that time, ...

On the contrary, after I had clarified my proposal by showing actual  
wording, Russ essentially acepted it, and indeed he improved it (modulo  
actual wordsmithing).

-- 
Charles H. Lindsey ---------At Home, doing my own thing------------------------
Tel: +44 161 436 6131                       
   Web: http://www.cs.man.ac.uk/~chl
Email: [email-masked]      Snail: 5 Clerewood Ave, CHEADLE, SK8 3JU, U.K.
PGP: 2C15F1A9      Fingerprint: 73 6D C2 51 93 A0 01 E7 65 E8 64 7E 14 A4 AB A5