Re: [dns-privacy] Murray Kucherawy's No Objection on draft-ietf-dprive-xfr-over-tls-11: (with COMMENT)

[Sara Dickinson <[e-mail]>]

> On 6 May 2021, at 07:18, Murray Kucherawy via Datatracker <[e-mail]> wrote:
> 
> Murray Kucherawy has entered the following ballot position for
> draft-ietf-dprive-xfr-over-tls-11: No Objection
> 
> When responding, please keep the subject line intact and reply to all
> email addresses included in the To and CC lines. (Feel free to cut this
> introductory paragraph, however.)
> 
> 
> Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
> for more information about DISCUSS and COMMENT positions.
> 
> 
> The document, along with other ballot positions, can be found here:
> https://datatracker.ietf.org/doc/draft-ietf-dprive-xfr-over-tls/
> 
> 
> 
> ----------------------------------------------------------------------
> COMMENT:
> ----------------------------------------------------------------------
> 
> With my BCP 14 language complainer hat on:
> 
> Section 7:
> 
> * "Implementations SHOULD use [RFC7828] [...] to manage persistent
> connections." -- since this is a SHOULD, can you suggest why an implementer
> might opt not to do this?  Section 7.3.1 does a great job of handling the
> SHOULD it presents, for example.

Implementations typically include an option to use fixed timeouts on either side of a connection for simplicity which can work just fine for e.g., low transfer rates - I could add text to that effect?

> 
> Sections 7.3.2 and 7.3.3:
> 
> * Same issue as above with the SHOULDs here.

Short answer, backwards compatibility.

For 7.3.2 there was a discussion in the working group about the significant code complexity involved for several implementations to meet all 3 requirements (particularly the second two points).  Since the performance improvements gained from these features is desirable, but not a critical for XFR, the discussion resulted in the SHOULD. Again, could add text on that if needed?

For 7.3.3, there is no previous specification for this behaviour and nameservers may behave differently today, hence the SHOULD here. 


> 
> Section 7.4:
> 
> * "Therefore, it is RECOMMENDED that [...] there SHOULD be no more than [...]."
> -- I don't know how to reconcile this RECOMMENDED-SHOULD combination in the
> same sentence.  I suggest that the first clause can be dropped with no loss of
> meaning.

Double checking this I remembered that for consistency the text is actually lifted and tweaked from RFC7766 which it is updating which said:
“It is RECOMMENDED that for any given
   client/server interaction there SHOULD be no more than one connection
   for regular queries, one for zone transfers, and one for each
   protocol that is being used on top of TCP (for example, if the
   resolver was using TLS). "

So we could update it if you feel very strongly?

> 
> Everything else is nits, some of which were probably also mentioned by others:
> 
> Section 1:
> 
> * "authoritatives" should probably be "authoritative nameservers"
> 
> * "authenticated denial of existences records" -- s/existences/existence/
> 
> Section 4:
> 
> * "The proposed mechanisms does not attempt" -- s/does/do/, or
> s/mechanisms/mechanism/
> 
> Section 6:
> 
> * "term is used to encompasses" -- s/encompasses/encompass/, or remove "is used
> to"
> 
> Sections 6.1 and 6.2
> 
> * "higher than the secondaries serial" -- s/secondaries/secondary's/
> 
> Section 6.2:
> 
> * "So there may be a fourth step above where [...].  There may also be a fourth
> step where [...]." -- so there can be two "fourth" steps?
> 
> Section 6.3:
> 
> * "This section attempts to presents" -- remove "attempts to", or
> s/presents/present/
> 
> * In the second paragraph, I think you need a comma after "servers”.

Thanks for these - some but not all were caught by others!

Regards

Sara.