Re: Next step for draft-ietf-6man-rfc6874bis

Dear authors and WG,

based on this WG last call, I reviewed the document. Overall, it is well written and mostly ready to publish, 
but I have a) one issue with the Security considerations section and b) a possibly stupid question on usefulness in web context:

a) The Security Considerations Section states:
>    It is conceivable that this format could be misused to probe a local
>    network configuration in some way.  However, that would only be
>    possible for an attacker that had already gained sufficient control
>    of a host to originate HTTP messages.  Such an attacker could more
>    easily probe using basic mechanisms such as the "ping" command.
   Is this true? What prevents an attack from embedding scoped IPv6 addresses in HTML documents, e.g., as part of an AD.
   While the security model of the browser/device should prevent abusing it from taking action REST calls to your home router, including a well-known image from such a device should be possible and could be used to verify an identity by linking to the EUI64 address of your home router and verifying the image was loaded. This is far easier than “pinging” the router.  

b) Assuming a device has only link-local connectivity and a web interface, is there a way to reference “same interface as used for this connection”? If not, such a web interface could only use relative links and things like re-direction to https will become hard.

AVE!
  Philipp   

> On 11. Jun 2022, at 03:56, Brian E Carpenter <brian.e.carpenter@gmail.com> wrote:
> 
> Dear 6man-chairs (especially Jen),
> 
> The authors believe that this draft is now stable and we request a WG Last Call. It would be nice to get this done before the IETF meeting.
> 
> Regards
>   Brian Carpenter
> 
> On 19-May-22 12:52, Brian E Carpenter wrote:
>> There's been no more discussion for several weeks. Can we move
>> on to a WG Last Call?
>> Regards
>>     Brian Carpenter
>> On 08-Apr-22 14:29, Brian E Carpenter wrote:
>>> Hi,
>>> 
>>> This version reflects comments at the IETF and on the list.
>>> Change log:
>>> * Extended use cases (added Microsoft WSD)
>>> * Clarified relationship with RFC3986 language
>>> * Allow for legacy use of RFC6874 format
>>> * Augmented security considerations
>>> * Editorial and reference improvements
>>> 
>>> Note that some of the text about RFC3986 that Shang Ye
>>> suggested to remove has been retained, but modified. Further
>>> comments about this, or any other aspect, are very welcome.
>>> 
>>> Regards
>>>      Brian + co-authors
>>> 
>>> On 08-Apr-22 14:13, internet-drafts@ietf.org wrote:
>>>> 
>>>> A New Internet-Draft is available from the on-line Internet-Drafts directories.
>>>> This draft is a work item of the IPv6 Maintenance WG of the IETF.
>>>> 
>>>>           Title           : Representing IPv6 Zone Identifiers in Address Literals and Uniform Resource Identifiers
>>>>           Authors         : Brian Carpenter
>>>>                             Stuart Cheshire
>>>>                             Robert M. Hinden
>>>> 	Filename        : draft-ietf-6man-rfc6874bis-01.txt
>>>> 	Pages           : 13
>>>> 	Date            : 2022-04-07
>>>> 
>>>> Abstract:
>>>>      This document describes how the zone identifier of an IPv6 scoped
>>>>      address, defined as <zone_id> in the IPv6 Scoped Address Architecture
>>>>      (RFC 4007), can be represented in a literal IPv6 address and in a
>>>>      Uniform Resource Identifier that includes such a literal address.  It
>>>>      updates the URI Generic Syntax and Internationalized Resource
>>>>      Identifier specifications (RFC 3986, RFC 3987) accordingly, and
>>>>      obsoletes RFC 6874.
>>>> 
>>>> 
>>>> The IETF datatracker status page for this draft is:
>>>> https://datatracker.ietf.org/doc/draft-ietf-6man-rfc6874bis/
>>>> 
>>>> There is also an HTML version available at:
>>>> https://www.ietf.org/archive/id/draft-ietf-6man-rfc6874bis-01.html
>>>> 
>>>> A diff from the previous version is available at:
>>>> https://www.ietf.org/rfcdiff?url2=draft-ietf-6man-rfc6874bis-01
>>>> 
>>>> 
>>>> Internet-Drafts are also available by rsync at rsync.ietf.org::internet-drafts
>>>> 
>>>> 
>>>> _______________________________________________
>>>> I-D-Announce mailing list
>>>> I-D-Announce@ietf.org
>>>> https://www.ietf.org/mailman/listinfo/i-d-announce
>>>> Internet-Draft directories: http://www.ietf.org/shadow.html
>>>> or ftp://ftp.ietf.org/ietf/1shadow-sites.txt
>>>> 
> 
> --------------------------------------------------------------------
> IETF IPv6 working group mailing list
> ipv6@ietf.org
> Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
> --------------------------------------------------------------------
> 

--  
Philipp S. Tiesel
https://philipp.tiesel.net/