Re: [core] AD review of draft-ietf-core-resource-directory-23

[Jaime Jiménez <[e-mail]>]

Dear all,

sorry for the delay on this discussion. We have had a parallel thread and now I realise the discussion was not on the list nor with the ADs on it. 

Christian can correct me but the current situation is that the two outstanding issues can be solved:

> >    This section describes how the registering endpoint can maintain the
> >    registrations that it created.  The registering endpoint can be the
> >    registrant-ep or the CT.  An endpoint SHOULD NOT use this interface
> >
> > Why SHOULD NOT (instead of MUST NOT) and how is this enforced?

There was a previous reply from Christian on this, which makes me (and I suppose others) to lean towards keeping the SHOULD  NOT.

"This is more expressing the intention than anything enforcable. Frankly,
it is a bit imprecise: The goal is to discourage any agents enumerating
registrations from the endpoint lookup and trying to enhance them.
Endpoints switching addresses (thus technically becoming different
endpoints) and updating their registration is encouraged.

There are some cases in the middle we probably don't want to rule out
but caution against, invoking "SHOULD"'s "know what you're doing" which
we may not want to rule out (but have not discussed).

In the end, enforcement is up to the security policy -- if an agent
knows a registration URI and has the authorization to act on it, that
will succeed."

> >
> >    for registrations that it did not create.  The registrations are
> >    resources of the RD. 
>   [snip]
> > At the end of section 9.3:
> >    It is expected that the registry will receive between 5 and 50 
> > registrations in total over the next years.
> >
> > This will not age well! Maybe remove this text from the document and 
> > add it to the spherding write-up?

Christian will remove the paragraph and I'll update the writeup.


Thanks!
-- Jaime