Re: [bfcpbis] Spencer Dawkins' Yes on draft-ietf-bfcpbis-bfcp-websocket-13: (with COMMENT)

[Spencer Dawkins at IETF <[e-mail]>]

Hi, Ram,

On Mon, Jan 30, 2017 at 8:24 PM, Ram Mohan R (rmohanr) <[e-mail]>
wrote:

> Hi Spencer,
>
> Thanks for your feedback. Please see inline <Ram>
>
> -----Original Message-----
> From: Spencer Dawkins <[e-mail]>
> Date: Tuesday, 17 January 2017 at 9:17 PM
> To: The IESG <[e-mail]>
> Cc: "[e-mail]" <draft-ietf-bfcpbis-bfcp-
> [e-mail]>, "Charles Eckel (eckelcu)" <[e-mail]>, "
> [e-mail]" <[e-mail]>, "Charles Eckel
> (eckelcu)" <[e-mail]>, "[e-mail]" <[e-mail]>
> Subject: Spencer Dawkins' Yes on draft-ietf-bfcpbis-bfcp-websocket-13:
> (with COMMENT)
> Resent-From: <[e-mail]>
> Resent-To: <[e-mail]>, <[e-mail]>, <
> [e-mail]>, <[e-mail]>, <[e-mail]>,
> <[e-mail]>
> Resent-Date: Tuesday, 17 January 2017 at 9:17 PM
>
>     Spencer Dawkins has entered the following ballot position for
>     draft-ietf-bfcpbis-bfcp-websocket-13: Yes
>
>     When responding, please keep the subject line intact and reply to all
>     email addresses included in the To and CC lines. (Feel free to cut this
>     introductory paragraph, however.)
>
>
>     Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.
> html
>     for more information about IESG DISCUSS and COMMENT positions.
>
>
>     The document, along with other ballot positions, can be found here:
>     https://datatracker.ietf.org/doc/draft-ietf-bfcpbis-bfcp-websocket/
>
>
>
>     ----------------------------------------------------------------------
>     COMMENT:
>     ----------------------------------------------------------------------
>
>     I have a couple of questions on authentication in this draft.
>
>     Does this text,
>
>           Since the WebSocket API does not distinguish between certificate
>           errors and other kinds of failure to establish a connection, it
>     is
>           expected that browser vendors will warn end users directly of any
>           kind of problem with the server certificate.
>
>     apply to any WebSocket-based application?
>
> <Ram> Yes. This is nothing specific to BFCP over webSocket. I think
> perhaps this text is not a right fit for this document. I do see RFC6455
> (like in section 7.1.7) already talk about webSocket API and at certain
> places on indicating failures to users. I will remove this text from this
> spec.
>
>     In this text,
>
>        A floor control server that receives a message over TCP/WS can
>        request the use of TCP/WSS by generating an Error message, as
>        described in Section 13.8 of [I-D.ietf-bfcpbis-rfc4582bis], with an
>        Error code with a value of 9 (use TLS).
>
>     is "request" the right word? Or is "require" more accurate, if the
> server
>     isn't going to establish a TCP/WS connection?
>
> <Ram> I think requires is appropriate here. I will re-word the text to:
>
> NEW:
>      A floor control server that receives a message over TCP/WS can
>       mandate the use of TCP/WSS by generating an Error message, as
>        described in Section 13.8 of [I-D.ietf-bfcpbis-rfc4582bis], with an
>        Error code with a value of 9 (use TLS).
>
>     Is the above ok ?


Both resolutions work for me (but do the right thing!).

Spencer