[Insipid] Alexey Melnikov's No Objection on draft-ietf-insipid-logme-marking-12: (with COMMENT)

Alexey Melnikov <aamelnikov@fastmail.fm> Thu, 16 August 2018 13:33 UTC

MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit
From: Alexey Melnikov <aamelnikov@fastmail.fm>
To: The IESG <iesg@ietf.org>
Cc: draft-ietf-insipid-logme-marking@ietf.org, insipid-chairs@ietf.org, gsalguei@cisco.com, insipid@ietf.org
Auto-Submitted: auto-generated
Precedence: bulk
Message-ID: <153442643819.7970.3404089925141918497.idtracker@ietfa.amsl.com>
Date: Thu, 16 Aug 2018 06:33:58 -0700
Archived-At: <https://mailarchive.ietf.org/arch/msg/insipid/kItzY-mwaX7tJ-LDnNiU9aLreTY>
Subject: [Insipid] Alexey Melnikov's No Objection on draft-ietf-insipid-logme-marking-12: (with COMMENT)

Alexey Melnikov has entered the following ballot position for
draft-ietf-insipid-logme-marking-12: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)


Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.


The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-insipid-logme-marking/



----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Similar to Benjamin, I am uneasy about this document and dual use of this
mechanism. I think the advice it gives for an attacker is to inject the "log
me" attribute at the beginning of a session that is of interest, closer to the
originator ;-).

Also one small nit:

In Section 1:

   This document defines a new header field parameter "logme" for the
   "Session-ID" header field [RFC7989].  Implementations of this
   document MUST implement session identity.

Is "session identity" defined in RFC 7989? RFC 7989 doesn't use the term
"session identity" anywhere. If you mean that in order to support this
extension one needs to implement support for the Session-ID header field I
suggest you rephrase the 2nd sentence to say something like this:

   Implementations of this document MUST implement [RFC7989].

[Insipid] Alexey Melnikov's No Objection on draft… Alexey Melnikov