Subject: [Slim] Mirja Kühlewind's No Objection on draft-ietf-slim-multilangcontent-13: (with COMMENT)

From: Mirja Kühlewind <[email-masked]>
Date: Tue, 15 Aug 2017 05:24:20 -0700

Mirja Kühlewind has entered the following ballot position for
draft-ietf-slim-multilangcontent-13: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-slim-multilangcontent/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Minor comments:
- sec 3.2:
"If there is a From field present, its value MUST
   include the same email address as the top-level From header..."
What happen if they are no the same? The security considerations section
mentions this case but there is no guidance given what to do in this case
(which address to display)?

- The security considerations section mentions the risk that the content might
actually be different in different languages. I think it would be nice to give
some recommendation that there SHOULD be a way for the user to see all content
fields.

---

From: Nik Tomkinson <[email-masked]>
Date: Fri, 18 Aug 2017 00:53:24 +0100

Hi Mirja,

Regarding the mismatched email addresses, I'll have a think and add some
text to the I-D.

Regarding the second point, the last paragraph in section 4 says that
'Additionally, interactive implementations MAY offer the user a choice from
among the available languages'. Is this what you had in mind or do you
think this should be also mentioned in the Security Considerations as a
mitigating response to the risk?

Nik.

-- 

-----------------------------------------------------------------
Multiple Language Content Type Internet Draft:

-----------------------------------------------------------------

---

From: "Mirja Kuehlewind (IETF)" <[email-masked]>
Date: Fri, 18 Aug 2017 10:49:53 +0200

Hi Nik,

see below.

> Am 18.08.2017 um 01:53 schrieb Nik Tomkinson <[email-masked]>:
> 
> Hi Mirja,
> 
> Regarding the mismatched email addresses, I'll have a think and add some text to the I-D.

Great!

> 
> Regarding the second point, the last paragraph in section 4 says that 'Additionally, interactive implementations MAY offer the user a choice from among the available languages'. Is this what you had in mind or do you think this should be also mentioned in the Security Considerations as a mitigating response to the risk?

I was rather thinking about providing a way to see multiple or all languages. So that someone how speaks multiples languages or what to manually apply some translation system, could check if the content is the same. So yes, it would be good to mention this in the security considerations but there might also be other use case, e.g. I read it in my prefer language but there is some unclarity and reading another version in another language could help to clarify the meaning. So maybe it’s something you want to mention earlier as well and just refer to in the security considerations.

Mirja

---

From: Nik Tomkinson <[email-masked]>
Date: Fri, 18 Aug 2017 14:02:16 +0100

Hi Mirja,

I have added some text and made some recommendations in a new version which
I have just submitted.

I think it suitably addresses the use case without adding too strong a
requirement to the specification.

Nik.

On 18 August 2017 at 09:49, Mirja Kuehlewind (IETF) <[email-masked]>
wrote:

> I was rather thinking about providing a way to see multiple or all
> languages. So that someone how speaks multiples languages or what to
> manually apply some translation system, could check if the content is the
> same. So yes, it would be good to mention this in the security
> considerations but there might also be other use case, e.g. I read it in my
> prefer language but there is some unclarity and reading another version in
> another language could help to clarify the meaning. So maybe it’s something
> you want to mention earlier as well and just refer to in the security
> considerations.
>
> Mirja
>
> >
> > Nik.
> >

--