Re: [Extra] Roman Danyliw's No Objection on draft-ietf-extra-quota-07: (with COMMENT)

[Alexey Melnikov <[e-mail]>]

Hi Roman,

Thank you for your comments.

On 18/10/2021 17:55, Roman Danyliw via Datatracker wrote:
> ----------------------------------------------------------------------
> COMMENT:
> ----------------------------------------------------------------------
>
> ** Section 8.  Should the prohibition on revealing quota information be a bit
> stronger? OLD In
>     particular, no quota information should be disclosed to anonymous
>     users.
>
> NEW
> In particular, quota information SHOULD be disclosed only to authenticated and
> authorized users

All QUOTA commands are only available once the user is authenticated. 
However this gets a bit complicated, because "anonymous" users are 
classes as authenticated in SASL framework (when SASL ANONYMOUS 
authentication mechanism is used).

What I am trying to say is that the current text is actually more strict 
than some interpretations of your text.

In regards to "and authorized". Historically there are no per user 
control in server implementations about who can see quota information. I 
am a bit doubtful that server implementations would implement such 
control unless there is clearly provided benefits.

> ** Section 8.  Should it be noted that computing remaining resources might
> incur a load on the server.  Implementers might want to rate limit or return
> less precise computations when under higher load?
I see your point. I am more inclined to recommend caching this 
information. I've added some text on this.
> ** Typos
> Section 3.2.  Typo. s/arbitary/arbitrary/
>
> Section 3.2.  Typo. s/dependant/dependant/
Thanks, I already fixed these.