Re: [Jmap] Paul Wouters' No Objection on draft-ietf-jmap-sieve-20: (with COMMENT)

[Ken Murchison <[e-mail]>]

Hi Paul,

Thank you for the review.  Responses inline.


On 4/3/24 12:05 PM, Paul Wouters via Datatracker wrote:
> Paul Wouters has entered the following ballot position for
> draft-ietf-jmap-sieve-20: No Objection
>
> When responding, please keep the subject line intact and reply to all
> email addresses included in the To and CC lines. (Feel free to cut this
> introductory paragraph, however.)
>
>
> Please refer tohttps://www.ietf.org/about/groups/iesg/statements/handling-ballot-positions/  
> for more information about how to handle DISCUSS and COMMENT positions.
>
>
> The document, along with other ballot positions, can be found here:
> https://datatracker.ietf.org/doc/draft-ietf-jmap-sieve/
>
>
>
> ----------------------------------------------------------------------
> COMMENT:
> ----------------------------------------------------------------------
>
> I share the issues Roman mentioned in his comments. Additionally:
>
>          blobId: Id The id of the blob containing the raw octets of the script.
>
> How is this Id specified? Also in "(UTF-8) octets" ? Can it contain control characters?
> Similar for other entries that don't specify the type, eg "accountId".


The Id type is specified in RFC 8630, Section 1.2.  This draft reference 
that section (among others) under Notational Conventions.


>          onSuccessActivateScript: Id (optional)
>
> I read this first as "Id is optional" but after realizing this made no sense, I figured
> out that onSuccessActivateScript is optional. Perhaps write it as:


The trailing (optional) is a convention used frequently in RFC 8620, but 
to avoid confusion I am going to remove the (optional) suffixes and 
instead follow the lead of Section 4.2 of RFC 9404 and add "optional" 
to  the introductory sentence as such:

This is a standard "/set" method as described in [RFC8620 
<https://www.ietf.org/archive/id/draft-ietf-jmap-sieve-20.html#RFC8620>], 
Section 5.3 <https://rfc-editor.org/rfc/rfc8620#section-5.3> but with 
the following additional *optional* request arguments, either or both of 
which may be omitted:


>          onSuccessActivateScript (optional): Id
>
> or:
>
>          [optional] onSuccessActivateScript: Id
>
>
> While I agree that the Security Considerations are those of JMAP and Sieve, I found
> that neither of those try to confirm Sieve modifications with some interactive
> user (eg imagine it requiring FaceID on my iphone to modify Sieve scripts). This
> would harden things a bit but arguably that not this documents problem to solve.
>
>
>
-- 
Kenneth Murchison
Senior Software Developer
Fastmail US LLC