[Ecrit] Roman Danyliw's No Objection on draft-ietf-ecrit-similar-location-18: (with COMMENT)

[Roman Danyliw via Datatracker <[e-mail]>]

Roman Danyliw has entered the following ballot position for
draft-ietf-ecrit-similar-location-18: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)


Please refer to https://www.ietf.org/about/groups/iesg/statements/handling-ballot-positions/ 
for more information about how to handle DISCUSS and COMMENT positions.


The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-ecrit-similar-location/



----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Thank you to Scott Kelly for the SECDIR review.

** Section 6.  This document should have a normative reference to the schema
format used in this section.  Is that RELAX NG? or W3 Schema?  I’ll note that
[I-D.ietf-ecrit-lost-planned-changes] also doesn’t normatively reference a
schema format.

** Section 7.  Given the deployment models of LoST, is it expected that the
entire contents of the server database would be publicly available?  Would it
be an issue if large portions of the LoST back-end database (on the LoST
server) were revealed?  I ask because if the server is willing to correct
input/provide suggestions based on partial on invalid client input, a malicious
party could potentially use this to enumerate the database via high volume of
invalid/partial queries. If that’s a threat, then perhaps there should be a
form for rate limiting applied on the number of corrected queries permitted per
unit time.