Re: [Enum] Expert Review draft-goix-appsawg-enum-acct-uri: Approved

Hi Peter, Bernie, folks,
OK --- I guess your concern is 2119 style commands to humans?
Re. user role -- well, a user who wants to tell people his/her account may well NOT be a zone maintainer, but his/her choice may well control the behaviour of the zone maintainer.

Given the level of self-publication of PII on web services [like twitter or facebook] that the general populace seems to be happy to do, it's fairly obvious that we can tell them, but they may well not listen.
However, we can at least give the 2119-like uses as strong advice to any publisher (but, as in all things, IANAL and nor is anyone else here).
How else could we stress that these concerns really, definitely, should be on the user's list of things to think about?

If (say) a carrier or SNEW provider wants to use this scheme to publish acct data for users, then it really has to consider what data is published in DNS (and so is available to all).
If not, and it has the joy of being in EU jurisdictions, it might (just might) be sued under national embodiments of the EU Data Protection Directive.
So ... the user choice ("yes please tell the world my account name") may well require the potential publisher to say "did you REALLY mean that?" to get legal cover.

I can also imagine a carrier being more comfortable limiting publication using a split-horizon DNS model (as in the two examples in the doc).
One set of data for my systems because I'm liable for those anyway, with another for brother carriers to query; a private and semi-private ENUM scheme.

Re. public ENUM: concern on limiting publication of PII is not specific to this doc -- it's general to any RRSET.
We DID discuss advice on limiting PII publication in ENUM (and so in public ENUM); honest.
I have to admit, it didn't make it into 5483 or 6116, as (at the time) Security Considerations didn't really extend to privacy. Sigh.
It is, however, a requirement in 6117 -- if it wasn't mentioned in the acct Enumservice document, Bernie would have had to ask for it to be added.

all the best,
  Lawrence

On 13 Jan 2014, at 15:08, Peter Koch wrote:
> Bernie,
> 
>> Please be informed that after all issues could be resolved with the 
>> authors, the document draft-goix-appsawg-enum-acct-uri-06 has been expert 
>> approved.
> 
> it's been a while that i read and commented on a very early version, so here's
> a question. How would this paragraph in section 7 be interpreted:
> 
>   Users MUST therefore carefully consider the information provided in
>   the resource identified by the ENUM record as well as in the record
>   itself.  Considerations SHOULD include serving information only to
>   entities of the user's choice and/or limiting the comprehension of
>   the information provided based on the identity of the requestor.
> 
> Normative language is a bit tricky when it comes to directing human,
> especially end user, behaviour. In this particular case, it seems to suggest
> the user acts as a publisher (or, say, zone maintainer) and also seems to encourage
> selective publication even in the public ENUM tree?
> 
> -Peter
> _______________________________________________
> enum mailing list
> enum@ietf.org
> https://www.ietf.org/mailman/listinfo/enum