Re: [art] Ben Campbell's No Objection on draft-ietf-appsawg-file-scheme-15: (with COMMENT)

["Ben Campbell" <[e-mail]>]

Hi Matthew,

On 15 Dec 2016, at 0:09, Matthew Kerwin wrote:

> Hi Ben,
>
> From: Ben Campbell [mailto:[e-mail]]
> Sent: Thursday, 15 December 2016 07:10
>>
>> - Section 5: "Implementers MUST research" and "Care MUST be taken"
>> both seem like requirements on people, not on implementations.
>> Furthermore, "research" and "taking of care" are vague in terms of
>> expected results.
>> Can these be recast into concrete expectations of implementation
>> behavior?
>
> I understand what you're asking, and why, but I don't know if it's 
> within my wordsmithing capabilities.  If I changed the RFC2119 
> normative keywords to regular English words I think that would make 
> the problem go away; would the resulting text be enough for security 
> considerations?
>
> The "MUST research" paragraph comes almost verbatim from RFC3986, 
> Section 7.5, but that says "should" instead of "MUST" -- I'd be happy 
> to move back in that direction here.

I think using normal English words (as in not 2119 keywords.) makes 
sense here. You can say important things without 2119 keywords.

An alternative would be to state it in terms of implementation behavior. 
For example: "Implementations MUST restrict the use of data obtained 
from URI components according to the reserved names and characters of 
the attached storage device"

But given that I think the point is that "implementors need to think 
about these issues and do the right thing", dropping the 2119 keywords 
is probably the best approach.

Thanks!

Ben.