Re: [bfcpbis] AD evaluation: draft-ietf-bfcpbis-bfcp-websocket-11

HI Alissa,

Thanks for your feedback. I have addressed the below comments except the one on author list which we will discuss and address later and published a new revision.

Regards,
Ram

-----Original Message-----
From: bfcpbis <bfcpbis-bounces@ietf.org> on behalf of Alissa Cooper <alissa@cooperw.in>
Date: Friday, 9 December 2016 at 10:33 PM
To: "bfcpbis@ietf.org" <bfcpbis@ietf.org>
Subject: [bfcpbis] AD evaluation: draft-ietf-bfcpbis-bfcp-websocket-11

    I have reviewed this document in preparation for IETF last call. It is in good shape but I have a couple of comments to discuss before issuing the last call. I’ve also included some nits below that should be resolved together this IETF LC comments.

    Substantive comments:

    = Section 5 =

    "The BFCP server is a server, on the Internet, and thus doesn't need
       ICE and thus the clients always initiate connection to it, and the
       clients only validate its certificate and the clients do not include
       their certificate in TLS ClientHello."

    This is text from the SDP directorate review of draft-ietf-bfcpbis-sdp-ws-uri right? I'm not really clear on why all of it needs to be in this document, or in this section which is about transport reliability, at least. I would suggest:

    "The BFCP server is a server on the Internet and thus does not require ICE as clients always initiate connections to it."

    = Section 6.2 =

    s/as the a=ws-uri or a=wss-uri SHALL provide port number when needed./as the a=ws-uri or a=wss-uri SHOULD provide port number when needed./

    If it's not always needed then SHOULD is more appropriate than SHALL.

    = Section 8 =

    OLD
    The BFCP client validates the server by means of verifying server certificate and this requires wss-uri contains a hostname. a=fingerprint is not used here in the verification process.

    NEW
    The BFCP client validates the server by means of verifying the server certificate. This means the wss-uri MUST contain a hostname. The verification process does not use a=fingerprint.

    = Section 9 =

    Don't the security considerations from RFC 6455 apply as well?

    = Section 12.1 =

    I think RFC 7525 and draft-ietf-bfcpbis-rfc4583bis should be normative references.

    Nits:

    = General =

    Per the RFC style guide, when a document has more than 5 authors, 1 or 2 editors should be chosen and the remaining authors listed in the Contributors section.

    = Section 4.1 =

    s/the value "bfcp"/the value "BFCP"/

    = Section 6.1 =

    s/When TCP is used as the transport, the port field is set following/The port field is set following

    OLD
    So, while the recommendation to use Secure WebSockets (i.e.
       TCP/WSS) is for security reasons, it is also to achieve maximum
       compatibility among clients.

    NEW
    So, while this document recommends the use of Secure WebSockets (i.e.
       TCP/WSS) for security reasons, TCP/WS is also permitted so as to achieve maximum
       compatibility among clients.

    = Section 6.2 and 7.1 =

    These sections have formatting problems and repeated text that need to be fixed.

    = Section 8 =

    s/with webSocket server/with the WebSocket server/

    _______________________________________________
    bfcpbis mailing list
    bfcpbis@ietf.org
    https://www.ietf.org/mailman/listinfo/bfcpbis