Re: [apps-discuss] Ben Campbell's No Objection on draft-ietf-appsawg-rfc7001bis-09: (with COMMENT)

["Murray S. Kucherawy" <[e-mail]>]

Hi Ben,

On Wed, May 13, 2015 at 3:28 PM, Ben Campbell <[e-mail]> wrote:

>
> -- 2.6, 2nd paragraph:
>
> Why might one choose _not_ to include version tokens?
>

They've been optional since RFC5451.  None of the authentication methods
currently supported have any version other than the basic ones.  This was
added in anticipation of needing them, but that need has not (so far)
materialized.


> -- 2.7.7, first paragraph, last sentence:
>
> I’m not sure how such a “preference” should be applied for IANA stuff
>

The Designated Expert for the registry can insist on something be published
if the description associated with a result code is non-trivial.  In the
spirit of keeping IANA requirements minimal, we chose not to require it.


> -- 4, last sentence:
>
> Known not to authenticate, or not known to authenticate?
>

"Known not" is correct.  For example, SPF does not authenticate the
local-part of an email address, so MUAs shouldn't claim that it did.


> -- 4.1, 2nd paragraph
>
> is it reasonable for users to be expected to know which services are used
> in their ADMDs?
>

If MUAs are using A-R content for filtering, then yes, that's the
assumption.


> -- 5, last paragraph:
>
> How do you imply a version?
>

The ABNF in Section 2.2 says the version of this specification is "1", and
that's the version of A-R assumed to be in use if no version is explicitly
provided; it's implied by the generator and inferred by the consumer.

-MSK