Re: [core] AD review of draft-ietf-core-resource-directory-23

[Alexey Melnikov <[e-mail]>]

Hi Jaime,

On 16/04/2020 11:35, Jaime Jiménez wrote:
> Dear all,
>
> sorry for the delay on this discussion. We have had a parallel thread and now I realise the discussion was not on the list nor with the ADs on it.
Yes, that didn't help ;-).
> Christian can correct me but the current situation is that the two outstanding issues can be solved:
>
>>>     This section describes how the registering endpoint can maintain the
>>>     registrations that it created.  The registering endpoint can be the
>>>     registrant-ep or the CT.  An endpoint SHOULD NOT use this interface
>>>
>>> Why SHOULD NOT (instead of MUST NOT) and how is this enforced?
> There was a previous reply from Christian on this, which makes me (and I suppose others) to lean towards keeping the SHOULD  NOT.
>
> "This is more expressing the intention than anything enforcable. Frankly,
> it is a bit imprecise: The goal is to discourage any agents enumerating
> registrations from the endpoint lookup and trying to enhance them.
> Endpoints switching addresses (thus technically becoming different
> endpoints) and updating their registration is encouraged.
>
> There are some cases in the middle we probably don't want to rule out
> but caution against, invoking "SHOULD"'s "know what you're doing" which
> we may not want to rule out (but have not discussed).
>
> In the end, enforcement is up to the security policy -- if an agent
> knows a registration URI and has the authorization to act on it, that
> will succeed."

Two comments on this:

1) If this is not supposed to be enforcable, then the document shouldn't 
use RFC 2119 language in this sentence, I think lowercase "should" would 
be much better.

2) This is related to my question (I believe I've asked it earlier) 
about how security policy is going to be implemented in relationship to 
resource directory. What are the current or expected mechanism? The 
document is silent about that and this causes me concerns.

>>>     for registrations that it did not create.  The registrations are
>>>     resources of the RD.
>>    [snip]
>>> At the end of section 9.3:
>>>     It is expected that the registry will receive between 5 and 50
>>> registrations in total over the next years.
>>>
>>> This will not age well! Maybe remove this text from the document and
>>> add it to the spherding write-up?
> Christian will remove the paragraph and I'll update the writeup.

Great.

Best Regards,

Alexey