Re: [ippm] Secdir last call review of draft-ietf-ippm-initial-registry-12

["MORTON, ALFRED C (AL)" <[e-mail]>]

Hi Paul,

Thanks for your review and comments, please see below.

Al

> -----Original Message-----
> From: Paul Wouters via Datatracker [mailto:[e-mail]]
> Sent: Friday, November 1, 2019 9:13 AM
> To: [e-mail]
> Cc: [e-mail]; [e-mail];
> [e-mail]
> Subject: Secdir last call review of draft-ietf-ippm-initial-registry-12
> 
> Reviewer: Paul Wouters
> Review result: Has Issues
> 
> I have reviewed this document as part of the security directorate's ongoing
> effort to review all IETF documents being processed by the  IESG.  These
> comments were written primarily for the benefit of the  security area
> directors.  Document editors and WG chairs should treat these comments just
> like any other last call comments.
> 
> As this document populates an IANA registry with metrics values, no security
> considerations apply. This is stated in the Security Section.
> 
> Normally, the IANA considerations are within one section and all other sections
> are written as if this has already been done, except with a [TBD] for any value
> IANA needs to put in. But this document uses text outside the Iana
> Considerations section like:
> 
>       "IANA is asked to assign different numeric identifiers to each of the two
>       Named Metrics."
> 
> It is better to rewrite this with clear text stating Name X is assigned value [TBD]
[acm] 
Thanks, I'll be working with IANA reps to resolve issues, too.
This hasn't come in previous IANA reviews, but we'll end
with wording that is clear and your suggestion is a good one.

> 
> Similarly, the document has "Change Controller", but the way this is normally
> phrased is to be part of the new Registry definition of "Registration
> Procedure(s)" which has defined values like "Expert review",
> "Specification Required", "First Come First Serve", etc. The document should be changed
> to reflect these standard types of policies, and ask IANA to create the
> Registries with the standardized procedure terms for updating those registries.
> 
[acm] 
I understand that the preferred entries under Change Controller 
are under discussion, and we are holding for guidance there.
In the Registry procedures, we currently call-out Expert Review
for the Registration Procedure, and it seems we may change to 
Specification Required.  Again, discussion with IANA will determine
the answer - the authors want this be as IANA-friendly as possible.