[Cbor] Roman Danyliw's Discuss on draft-ietf-cbor-file-magic-11: (with DISCUSS and COMMENT)

[Roman Danyliw via Datatracker <[e-mail]>]

Roman Danyliw has entered the following ballot position for
draft-ietf-cbor-file-magic-11: Discuss

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)


Please refer to https://www.ietf.org/about/groups/iesg/statements/handling-ballot-positions/ 
for more information about how to handle DISCUSS and COMMENT positions.


The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-cbor-file-magic/



----------------------------------------------------------------------
DISCUSS:
----------------------------------------------------------------------

Section 2.1.

(a) "In both enveloping methods, CBOR Protocol designers need to obtain a CBOR
tag for each kind of object that they might store on disk.  ... The IANA policy
for 4-byte CBOR Tags is First Come First Served, ..."

(b) "This tag needs to be allocated by the author of the CBOR Protocol."

Both of these statements are made in this section and they appear to conflict. 
(a) appears to be saying that CBOR tags will be allocated from the FCFS IANA
registry to the protocol designer.  However, later in the section (b) says that
the author is allocating the tags.  If the author performing the
allocation/assignment, it would seem to be coming from the registry per (a).


----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Thank to Chris Wood for the SECDIR review.  Please review the editorial
suggestions posed there.

** Section 2.2
   This method wraps the CBOR value as tags usually do.  Applications
   that need to send the CBOR value across a constrained link may wish
   to remove the two tags if the use is implicitly understood.

Is this behavior akin to not using this enveloping method?

** Section 3.3
   If the Protocol expects to use other tags values at the top-level,
   then the use of the tag wrapped format may be easier to explain in
   the protocol description.

(As also pointed by Chris Wood in the SECDIR review) This text would benefit
from refinement.  Specifically:

-- what does it mean to be “easier to explain in the protocol description”?

-- how does a top-level tag that isn’t one of the two approaches posed here
work with the rest of the behavior in this document?

** Section 4.  Consider adding the following generic text on relying on “magic
values”:

End-point assessment technologies should not solely rely on the meta data
approaches described in this document to decide whether to inspect a given file.

Depending on operating systems configurations and related properties of the
execution environment, use of these meta data approaches could influence the
default application used to process a file, regardless of whether this file in
fact contains CBOR.