Subject: [apps-discuss] Ben Campbell's No Objection on draft-ietf-appsawg-rfc7001bis-09: (with COMMENT)

From: "Ben Campbell" <[email-masked]>
Date: Wed, 13 May 2015 15:28:03 -0700

Ben Campbell has entered the following ballot position for
draft-ietf-appsawg-rfc7001bis-09: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-appsawg-rfc7001bis/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

-- 2.6, 2nd paragraph:

Why might one choose _not_ to include version tokens?

-- 2.7.7, first paragraph, last sentence:

I’m not sure how such a “preference” should be applied for IANA stuff

-- 4, last sentence:

Known not to authenticate, or not known to authenticate?

-- 4.1, 2nd paragraph

is it reasonable for users to be expected to know which services are used
in their ADMDs?

-- 5, last paragraph:

How do you imply a version?

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Wed, 13 May 2015 15:56:56 -0700

Hi Ben,

> Why might one choose _not_ to include version tokens?

They've been optional since RFC5451.  None of the authentication methods
currently supported have any version other than the basic ones.  This was
added in anticipation of needing them, but that need has not (so far)
materialized.

> I’m not sure how such a “preference” should be applied for IANA stuff

The Designated Expert for the registry can insist on something be published
if the description associated with a result code is non-trivial.  In the
spirit of keeping IANA requirements minimal, we chose not to require it.

> Known not to authenticate, or not known to authenticate?

"Known not" is correct.  For example, SPF does not authenticate the
local-part of an email address, so MUAs shouldn't claim that it did.

> is it reasonable for users to be expected to know which services are used

If MUAs are using A-R content for filtering, then yes, that's the
assumption.

> How do you imply a version?

The ABNF in Section 2.2 says the version of this specification is "1", and
that's the version of A-R assumed to be in use if no version is explicitly
provided; it's implied by the generator and inferred by the consumer.

-MSK

---

From: "Ben Campbell" <[email-masked]>
Date: Wed, 13 May 2015 18:01:42 -0500

Thanks for the quick response--it addresses all of my 
questions/comments. None of them appear to need changes in the text.

Ben.