Re: [6tisch] Adam Roach's Discuss on draft-ietf-6tisch-minimal-security-13: (with DISCUSS and COMMENT)

[Adam Roach <[e-mail]>]

On 11/1/19 4:43 PM, Michael Richardson wrote:
> Adam Roach via Datatracker <[e-mail]> wrote:
>      > §8.1.1:
>
>      >> o The Uri-Path option is set to "j".
>
>      > COAP URIs are generally subject to BCP 190 restrictions, which would
>      > require the path to either be provisioned, discovered, or under the
>      > ".well-known" tree. The use of a reserved domain name here may change
>      > the rationale; but for the sake of not establishing a precedent for
>
> Yes, we think that it does.
> The Host: is "6tisch.arpa", so we think that we are the owner of the URI, as
> per BCP190 section 1, paragraph 3:
>
>     }  Because the owner of the URI (as defined in [webarch]
>     }  Section 2.2.2.1) is choosing to use the server or the application,
>     }  this can be seen as reasonable delegation of authority.
>
> How/where should we reference this?


Wherever you prefer. If I were editing the document, I would put it as 
an indented note paragraph directly under the bulleted list in Section 
8.1.1; but I defer to your judgement if you think it works better 
somewhere else.


>      > path squatting in CoAP, this document needs to clearly explain the
>      > rationale of why BCP 190 should not apply in this case. Alternately,
>      > the implied URI can be changed to something like
>      > "coap://6tisch.arpa/.well-known/j"
>
> We feel that those 11 bytes are not needed. We already didn't like the
> 6tisch.arpa part....


Understood. Ben pointed out something interesting that I didn't catch -- 
the text in Section 8.2.1 doesn't indicate what the "Uri-Host" value 
should be for parameter update exchange, and I can't quite figure out 
the answer myself. If it's supposed to be "6tisch.arpa", please add a 
bullet saying as much. If it's not "6tisch.arpa," then the URI ownership 
rationale above doesn't apply, and the path handling will need to change.

/a