Re: [Add] Orie Steele's No Objection on draft-ietf-add-resolver-info-12: (with COMMENT)

[[e-mail]]

Hi Orie, 

Thanks of the review. 

Please see inline.

Cheers,
Med

> -----Message d'origine-----
> De : Orie Steele via Datatracker <[e-mail]>
> Envoyé : lundi 1 avril 2024 19:06
> À : The IESG <[e-mail]>
> Cc : [e-mail]; [e-mail];
> [e-mail]; [e-mail]; [e-mail]
> Objet : Orie Steele's No Objection on draft-ietf-add-resolver-info-12:
> (with COMMENT)
> 
> 
> ----------------------------------------------------------------------
> COMMENT:
> ----------------------------------------------------------------------
> 
> Thanks to Arnt Gulbrandsen for the ARTART Review.
> Thanks to Tommy Jensen for the shepherd write up.
> 
> I support Paul's Discuss, and agree with many of his comments.
> 
> In particular, Arnt mentioned in his review similar concerns regarding
> Section
> 7.
> 
> In Section 5, is misleading IT staff a security issue?
> Its not clear how to protect end users in this section.
> Consider MUST NOT display the URL to end users.
> 
> If you retain the recommendation to use text/html consider adding some
> guidance
> regarding web app sec, scripts etc... This might better help explain
> your
> requirement to use HTTPS?
> 
> Prefer to see some concrete examples of acceptable strategies for
> managing
> reputation.
> 

[Med] The text already includes a set of examples of how that local policy can be implemented:

   If the client cannot validate the attributes received from the
   resolver, that will be used for resolver selection or displayed to
   the end-user, the client should process those attributes only if the
   encrypted resolver has sufficient reputation according to local
                                                ^^^^^^^^^^^^^^^^^^
   policy (e.g., user configuration, administrative configuration, or a
   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
   built-in list of reputable resolvers).
   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

We could simply delete "reputation" and go straight to "local policy" but we wanted to better insist on the reasoning for setting the policy.
____________________________________________________________________________________________________________
Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc
pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler
a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration,
Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci.

This message and its attachments may contain confidential or privileged information that may be protected by law;
they should not be distributed, used or copied without authorisation.
If you have received this email in error, please notify the sender and delete this message and its attachments.
As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified.
Thank you.