Re: [Id-event] AD review of draft-ietf-secevent-http-poll-06

["Richard Backman, Annabelle" <[e-mail]>]

Pull request submitted: https://github.com/independentid/Identity-Events/pull/33

–
Annabelle Backman (she/her)
AWS Identity
https://aws.amazon.com/identity/
 

On 4/29/20, 3:56 PM, "Mike Jones" <[e-mail]> wrote:

CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you can confirm the sender and know the content is safe.



Cool - thanks.

-----Original Message-----
From: Richard Backman, Annabelle <[e-mail]>
Sent: Wednesday, April 29, 2020 3:54 PM
To: Mike Jones <[e-mail]>; Benjamin Kaduk <[e-mail]>
Cc: [e-mail]; [e-mail]
Subject: [EXTERNAL] Re: [Id-event] AD review of draft-ietf-secevent-http-poll-06

Sorry, was waiting for confirmation that we're removing the sentence and not the paragraph. Yes, I'll remove the sentence and do another pull request. Once you confirm via pull request approval I'll publish the drafts.

–
Annabelle Backman (she/her)
AWS Identity
https://aws.amazon.com/identity/


On 4/28/20, 5:37 PM, "Mike Jones" <[e-mail]> wrote:

CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you can confirm the sender and know the content is safe.



Annabelle, do you want to remove the DDOS sentence or do you want me to?  After that, are we ready to publish both drafts?

                                Thanks,
                                -- Mike

-----Original Message-----
From: Benjamin Kaduk <[e-mail]>
Sent: Monday, April 27, 2020 4:53 PM
To: Richard Backman, Annabelle <[e-mail]>
Cc: Mike Jones <[e-mail]>; [e-mail]; [e-mail]
Subject: Re: [Id-event] AD review of draft-ietf-secevent-http-poll-06

Just the sentence about DoS attacks, not the whole paragraph, right?

-Ben

On Mon, Apr 27, 2020 at 11:52:03PM +0000, Richard Backman, Annabelle wrote:
> Yes, will remove that.
>
> –
> Annabelle Backman (she/her)
> AWS Identity
> https://aws.amazon.com/identity/
>
>
> On 4/27/20, 4:51 PM, "Mike Jones" <[e-mail]> wrote:
>
> CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you can confirm the sender and know the content is safe.
>
>
>
> Thanks for the edits you made, Annabelle.  Do we also want to delete this text from Poll before publishing, per Ben's suggestion?
>
>       <t>
>         Authorization for the eligibility to provide actionable SETs can be determined by
>         using the identity of the SET Issuer,
>         validating the polling endpoint URL, perhaps using TLS,
>         or via other employed authentication methods.
>         Among other benefits, authentication can help prevent denial-of-service attacks.
>         Because SETs are
>       not commands, SET Recipients are free to ignore SETs that
>       are not of interest after acknowledging their receipt.</t>
>
>                                 -- Mike
>
> -----Original Message-----
> From: Mike Jones
> Sent: Friday, April 24, 2020 7:12 PM
> To: 'Benjamin Kaduk' <[e-mail]>; [e-mail]
> Cc: [e-mail]; [e-mail]
> Subject: Re: [Id-event] AD review of draft-ietf-secevent-http-poll-06
>
> Thanks Ben.  I think the DDOS text can be dropped from Poll.  I'll do that early next week.
>
>                                 Thanks again,
>                                 -- Mike
>
> -----Original Message-----
> From: Benjamin Kaduk <[e-mail]>
> Sent: Friday, April 24, 2020 5:53 PM
> To: Mike Jones <[e-mail]>
> Cc: [e-mail]; [e-mail]
> Subject: [EXTERNAL] Re: [Id-event] AD review of draft-ietf-secevent-http-poll-06
>
> Hi Mike,
>
> Thanks for the updates, and I continue to be sorry for the long response times.
>
> Poll is in quite good shape (well, I guess it's mostly just that -push is taking the brunt of the work for harmonizing the differences in text); just a couple more changes to make and we should be good to start the IETF LCs in parallel.  I'll again trim the resolved bits.
>
> In Section 3 we have a note about DoS protections embedded in a larger block of text:
>
>    Authorization for the eligibility to provide actionable SETs can be
>    determined by using the identity of the SET Issuer, validating the
>    polling endpoint URL, perhaps using TLS, or via other employed
>    authentication methods.  Among other benefits, authentication can
>    help prevent denial-of-service attacks.  Because SETs are not
>    commands, SET Recipients are free to ignore SETs that are not of
>    interest after acknowledging their receipt.
>
> I am not 100% sure, but I think this may have been text that originates before the split of documents, and in push got extracted and made into a separate section.  Does it still make sense here?  The DoS risk would typically be for a server getting lots of inbound connections, but there's not quite as clear a case for (client) authentication helping with that for poll, since the client is not sending huge amounts of stuff that would need to be dropped.  Am I misunderstanding the intent here, or should the sentence just get dropped?
>
> On Fri, Feb 07, 2020 at 05:18:04PM +0000, Mike Jones wrote:
> > draft-ietf-secevent-http-poll-07<https://tools.ietf.org/html/draft-ietf-secevent-http-poll-07> was published to address these review comments.  (-08<https://tools.ietf.org/html/draft-ietf-secevent-http-poll-08> addressed additional editorial nits.)  Descriptions of the changes made for these comments are inline, prefixed by "Mike>".
> >
> >
> >
> > -----Original Message-----
> > From: Id-event <[e-mail]> On Behalf Of Benjamin Kaduk
> > Sent: Tuesday, December 10, 2019 4:37 PM
> > To: [e-mail]
> > Cc: [e-mail]
> > Subject: [Id-event] AD review of draft-ietf-secevent-http-poll-06
> >
> >
> > Section 3
> >
> >
> > Since poll has the TLS server as the SET Transmitter, we could potentially pull in RFC 6125 and talk about validating DNS-IDs to authenticate the Transmitter.  Given that the name to be authenticated would be part of the information conveyed out-of-band, though, it's not entirely clear how much value there would be in doing so.
> >
> >
> > Mike> As in Push, this section was formerly poorly worded, and has largely been rewritten.
>
> As for -push, I'd really like to be able to say something about the other half of the name comparison.  In this case would it be something like "discovery of SET Transmitters (and the names used to authenticate them) is out of scope for this document"?
>
> Thanks for the updates,
>
> Ben
>