[core] Benjamin Kaduk's No Objection on draft-ietf-core-too-many-reqs-05: (with COMMENT)

[Benjamin Kaduk <[e-mail]>]

Benjamin Kaduk has entered the following ballot position for
draft-ietf-core-too-many-reqs-05: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)


Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.


The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-core-too-many-reqs/



----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Section 3

It may be appropriate to explicitly reiterate that "The 4.29 response code is
only returned to the client(s) sending requests too frequently; if other
clients are sending requests that cannot be served due to server overload,
the 5.03 response code is more appropriate."

   If a client repeats a request that was answered with 4.29 before Max-
   Age time has passed, it is possible the client did not recognize the
   error code and the server MAY respond with a more generic error code
   (e.g., 5.03).

Isn't it also possible that the additional requests were already in flight
when the 4.29 was generated?  (It's unclear whether that needs to be
specifcially mentioned in the document.)

Section 5

As per the previous comment, a server that erroneously returns 4.29 to too
many (i.e., including well-behaving) clients would unnecessarily DoS the
well-behaved clients.

It may be appropriate to reference the RFC 7252 security considerations as
continuing to apply.