Re: [Cbor] Genart last call review of draft-ietf-cbor-cddl-control-05

Theresa Enghardt <ietf@tenghardt.net> Fri, 17 September 2021 22:07 UTC

Return-Path: <ietf@tenghardt.net>
X-Original-To: cbor@ietfa.amsl.com
Delivered-To: cbor@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 07BEF3A1866; Fri, 17 Sep 2021 15:07:21 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.099
X-Spam-Level:
X-Spam-Status: No, score=-2.099 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, NICE_REPLY_A=-0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, WEIRD_QUOTING=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=tenghardt.net
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zXvUaVxcXI4E; Fri, 17 Sep 2021 15:07:16 -0700 (PDT)
Received: from mail.hemio.de (mail.hemio.de [136.243.12.180]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2AA723A12FB; Fri, 17 Sep 2021 15:07:14 -0700 (PDT)
Received: from user.client.invalid (localhost [136.243.12.180]) by mail.hemio.de (Postfix) with ESMTPSA id A898CAA; Sat, 18 Sep 2021 00:07:09 +0200 (CEST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tenghardt.net; s=20170414; t=1631916431; bh=G3L9xZFnv+mWRHmryyWiQKgxPliaGAg5caJgtjUq32E=; h=Subject:To:Cc:References:From:Date:In-Reply-To:From; b=h6exGZRtwPW8cNO10DM/VYDplmR4yUMXel/zUFSQk37rBER4iNmBLDEjoP9epH/s2 y2AExda3UgPLfcmR4OQNQkzPjfimUIbkWWHe2zCQdW25vTVrKKhnwQEzE1cysPR5l8 VYkpR7vOI+3O0DoGkFHFJRmI1iI8E9yOwp4+7cyKcURv1bwajoTVgL+6f7BEE3kjbR +YyDXPilUKtKKGzVe88WEpKAz8JHBoXxMaDUE9M8iCFDvyrPsyEVMBlazJvpjrvmEl AZj49B9jMjhNKXEAE9e6eo7TQx6gJfYuj9tLU0YmLBgHJUSMp/5U9TMPWl+xIXL80J 7Hq8IXjy1udAA==
To: Carsten Bormann <cabo@tzi.org>
Cc: gen-art@ietf.org, cbor@ietf.org, draft-ietf-cbor-cddl-control.all@ietf.org, last-call@ietf.org
References: <163181597437.23922.16020691497893082297@ietfa.amsl.com> <B11E77F9-AA48-432F-83AD-BF78AD1F97D2@tzi.org>
From: Theresa Enghardt <ietf@tenghardt.net>
Message-ID: <be9615f6-8789-ca1b-eeea-cb341900975d@tenghardt.net>
Date: Fri, 17 Sep 2021 15:07:06 -0700
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Thunderbird/78.13.0
MIME-Version: 1.0
In-Reply-To: <B11E77F9-AA48-432F-83AD-BF78AD1F97D2@tzi.org>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 8bit
Content-Language: en-US
Archived-At: <https://mailarchive.ietf.org/arch/msg/cbor/g-7hhIKG1CTHUTTqvDoh2oKzng0>
Subject: Re: [Cbor] Genart last call review of draft-ietf-cbor-cddl-control-05
X-BeenThere: cbor@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "Concise Binary Object Representation \(CBOR\)" <cbor.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/cbor>, <mailto:cbor-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/cbor/>
List-Post: <mailto:cbor@ietf.org>
List-Help: <mailto:cbor-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/cbor>, <mailto:cbor-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 17 Sep 2021 22:07:21 -0000

Hi Carsten,

Thanks for the reply and changes, they look good to me.

On 9/17/21 8:28 AM, Carsten Bormann wrote:
>> Section 7 (Security considerations):
>> Can there be any additional security concerns if CDDL specifications can
>> contain ABNF or "arbitrary" features? While this document obviously can't go
>> into specifics, maybe it's worth calling out that one needs to pay specific
>> attention if these control operators are used.
> Isn’t that true for any extension to any language?
> I’d prefer to highlight specific security considerations when I’m aware of them.

Probably true, but I guess I prefer to state the obvious, especially 
when it comes to security, to be safer rather than sorry. Also I like it 
when a document that "builds" on another document still shows that the 
authors considered the implications of what they added.

That said, I won't argue with your reasoning :)


>> Nits/editorial comments:
>>
>> Section 2.2
>> "concatenating the target text string ""foo"""
>> Is foo intended to be in two double quotes, or should there only be one pair of
>> quotes?
> This is an artifact of the way xml2rfc handles <tt> elements.
> There currently is no way to mark the document up in a way such that both plain text and html versions look good, and I opted to prefer the HTML to look good (and correct).
> (RFC 8949 has a long explanation in several paragraphs of Section 1.2 how the plain text sometimes will look weird; I was hoping I wouldn’t have to repeat this here.)
> There is a proposed change to xml2rfc that will change the specifics, so I would like to wait for how that plays out before making changes.
>
>
>> Section 3
>> "by defining a ".abnf" control operator"
>> Should this say 'an ".abnf" control operator' instead?
> Actually, we say out loud “dot a b n f control operator”, so “a” corresponds to the speech pattern.

Thanks, I learned something in both of these cases.

Best,
Theresa