Subject: [Sidrops] I-D Action: draft-ietf-sidrops-https-tal-05.txt

From: [email-masked]
Date: Thu, 11 Oct 2018 03:49:07 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the SIDR Operations WG of the IETF.

        Title           : Resource Public Key Infrastructure (RPKI) Trust Anchor Locator
        Authors         : Geoff Huston
                          Samuel Weiler
                          George Michaelson
                          Stephen Kent
                          Tim Bruijnzeels
	Filename        : draft-ietf-sidrops-https-tal-05.txt
	Pages           : 10
	Date            : 2018-10-11

Abstract:
   This document defines a Trust Anchor Locator (TAL) for the Resource
   Public Key Infrastructure (RPKI).  This document obsoletes RFC 7730
   by adding support for HTTPS URIs in a TAL.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-sidrops-https-tal/

There are also htmlized versions available at:
https://tools.ietf.org/html/draft-ietf-sidrops-https-tal-05
https://datatracker.ietf.org/doc/html/draft-ietf-sidrops-https-tal-05

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-ietf-sidrops-https-tal-05

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Tim Bruijnzeels <[email-masked]>
Date: Thu, 11 Oct 2018 12:59:28 +0200

Dear WG,

I asked for last call on a previous version of this document back in April, but it got stuck somehow

However, this version -05 now includes an optional comments section at the start of the TAL file, which was suggested to me off list. The idea is that this section can be used to provide some additional information to operators.

I want to ask the WG to consider first. If there are no major concerns then I will ask the co-chairs to initiate last call.

Kind regards,

Tim

> On 11 Oct 2018, at 12:49, [email-masked] wrote:
> 
> 
> _______________________________________________
> Sidrops mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sidrops

---

From: Randy Bush <[email-masked]>
Date: Thu, 11 Oct 2018 09:42:54 -0700

> However, this version -05 now includes an optional comments section at
> the start of the TAL file, which was suggested to me off list. The
> idea is that this section can be used to provide some additional
> information to operators.

or at least that subset of operators who read tals before breakfast.

or, to put it less snarkily, if the information is actually of ops use,
burying it in a tal is a bit obscure.

randy

---

From: Tim Bruijnzeels <[email-masked]>
Date: Thu, 11 Oct 2018 21:00:10 +0200

Hi Randy,

This seems easy enough to parse or ignore. This MUST NOT prompt user actions, but might be shown in a log file or even UI. It might help some people concerned with showing restrictions or other info. So, this seems easy enough to me, and not harmful. But I am not married to this.

Tim

> On 11 Oct 2018, at 18:42, Randy Bush <[email-masked]> wrote:
>

---

From: Randy Bush <[email-masked]>
Date: Thu, 11 Oct 2018 12:11:12 -0700

hi tim,

> This seems easy enough to parse or ignore. This MUST NOT prompt user
> actions, but might be shown in a log file or even UI. It might help
> some people concerned with showing restrictions or other info. So,
> this seems easy enough to me, and not harmful. But I am not married to
> this.

oh.  more rir legal bumph.  got it.

randy

---

From: Tim Bruijnzeels <[email-masked]>
Date: Thu, 11 Oct 2018 21:16:48 +0200

That’s one application. And this could offer a pragmatic way forward. I am not thrilled, but would rather show text, then not be allowed to include TALs. But again I am not married to this, it’s easy enough to take out again.

> On 11 Oct 2018, at 21:11, Randy Bush <[email-masked]> wrote:
> 
> hi tim,
>

---

From: Job Snijders <[email-masked]>
Date: Fri, 12 Oct 2018 07:33:12 +0900

Hi,

The comment character will *maybe* help unblock some distribution issues
that some are facing in the North American region.

Kind regards,

Job

On Thu, Oct 11, 2018 at 19:59 Tim Bruijnzeels <[email-masked]> wrote:

> However, this version -05 now includes an optional comments section at the
> start of the TAL file, which was suggested to me off list. The idea is that
> this section can be used to provide some additional information to
> operators.
>
> I want to ask the WG to consider first. If there are no major concerns
> then I will ask the co-chairs to initiate last call.
>
> Kind regards,
>
> Tim
>
>
>
>

---

From: George Michaelson <[email-masked]>
Date: Fri, 12 Oct 2018 08:53:22 +0200

We need to deploy processes for TAL and repository fetch and
synchronisation which can move to CDN. As it stands, the design of the
repository fetch systems is heading to single points of failure
because Rsync is a very poor fit for anycast distribution (no
commercial entities I know of are offering it as a service, where all
of them offer HTTP(S) as a matter of course)

Please can we close on this draft, because its the simple, obvious
change to permit the TAL to be formally distributed by scaleable
mechanisms, and helps point a way out of what I feel is a major
operational design flaw.

The comments section has potential for people who are trapped behind
legal disclaimer issues. I understand some of you feel paying
attention to this is wrong, but it does not (to my mind) directly harm
the overall intend of the proposal to adopt HTTP(S) as a
carrier/transport to the data.

(speaking as a co-author)

-George
On Fri, Oct 12, 2018 at 12:33 AM Job Snijders <[email-masked]> wrote:
>
> Hi,
>
> The comment character will *maybe* help unblock some distribution issues that some are facing in the North American region.
>
> Kind regards,
>
> Job
>

---

From: Tim Bruijnzeels <[email-masked]>
Date: Wed, 17 Oct 2018 10:06:58 +0200

Hi,

> On 12 Oct 2018, at 08:53, George Michaelson <[email-masked]> wrote:
> 

I doubt very much that this will address the issues that ARIN sees, but one can hope.

But I see value in having comments when handling test TALs, and when TA key rolls become a thing (update on this coming in a few days). Having some comments as a hint to what / which key this TAL is about is helpful - I do not like guessing this from URIs or file names. This is mainly serving RP software developers in deciding which TALs to bundle, and people doing research. I understand that normal operators will most likely never see the TAL.

On the other side, I do not see any clear harm. Ignoring a bunch of lines starting with ‘#’ is trivial and RP software needs to be updated anyway to handle the ‘https’ case.

All this being said, I do not want this to block progress on the main effort here which is to include https on TALs.

Tim

---

From: Job Snijders <[email-masked]>
Date: Wed, 17 Oct 2018 10:08:54 +0200

Perhaps it is time for WG LC? I'd support that

---

From: George Michaelson <[email-masked]>
Date: Wed, 17 Oct 2018 10:16:28 +0200

Yes. I think its time for WGLC.

-G

---

From: Nick Hilliard <[email-masked]>
Date: Wed, 17 Oct 2018 11:10:54 +0200

WFM.

---

From: Tim Bruijnzeels <[email-masked]>
Date: Fri, 19 Oct 2018 15:05:47 +0200

Co-chairs, can you initiate a last call?

We can also have some mic time in Bangkok, but I hope that things are clear enough and this is not needed.

Thanks
Tim

> On 17 Oct 2018, at 11:10, Nick Hilliard <[email-masked]> wrote:
> 
> WFM.
>