Re: [mile] Alexey Melnikov's Discuss on draft-ietf-mile-rfc5070-bis-22: (with DISCUSS and COMMENT)

["Roman D. Danyliw" <[e-mail]>]

Hello Alexey,

> -----Original Message-----
> From: Alexey Melnikov [mailto:[e-mail]]
> Sent: Thursday, June 02, 2016 5:05 AM
> To: Roman D. Danyliw <[e-mail]>; The IESG <[e-mail]>
> Cc: [e-mail]; [e-mail];
> [e-mail]; [e-mail]; mile-
> [e-mail]
> Subject: Re: Alexey Melnikov's Discuss on draft-ietf-mile-rfc5070-bis-22:
> (with DISCUSS and COMMENT)
> 
> Hi Roman,
> 
> On Thu, Jun 2, 2016, at 06:15 AM, Roman D. Danyliw wrote:
> > Hi Alexey,
> >
> > Thanks for the review.  Responses to the DISCUSS and COMMENTs are
> > inline ...
> >
> > > -----Original Message-----
> > > From: Alexey Melnikov [mailto:[e-mail]]
> > > Sent: Wednesday, June 1, 2016 3:34 AM
> > > To: The IESG <[e-mail]>
> > > Cc: [e-mail]; Roman D. Danyliw
> > > <[e-mail]>; [e-mail]; [e-mail];
> > > [e-mail]; [e-mail]; [e-mail]
> > > Subject: Alexey Melnikov's Discuss on
> > > draft-ietf-mile-rfc5070-bis-22: (with DISCUSS and COMMENT)
> > >
> 
>  [snip]
> 
> > > --------------------------------------------------------------------
> > > --
> > > DISCUSS:
> > > --------------------------------------------------------------------
> > > --
> > >
> > > I will move to yes when the following issue is discussed.
> > >
> > > Robert Sparks' SecDir review reminded me: I am concerned by the
> > > requirement to automatically download updates from IANA. If many
> > > devices or software programs implement IODEF and start doing schema
> > > validation, this can cause DDoS attack on IANA infrastructure.
> >
> > A response to Robert's review can be found here:
> >
> > https://mailarchive.ietf.org/arch/msg/mile/hSH9Ot6L_VTb9zYcJNZzO_c-
> 7dc
> >
> > Note: I posed a few questions back to the working group, so not
> > everything is resolved.
> 
> Ok, I replied to that message.

Several changes were made in the text in -23 to address this concerns.  These are documented in SecDir review threads:

https://mailarchive.ietf.org/arch/msg/mile/cz8_ZoyVYZX88QUoqeEgZQFUrYE

https://mailarchive.ietf.org/arch/msg/mile/uPHPtq_PvUvxKTP4jKA5x6_y2Jg

> > > --------------------------------------------------------------------
> > > --
> > > COMMENT:
> > > --------------------------------------------------------------------

[snip]

> > > In 4.1: it would be good to point to the W3C XML document about
> > > rules for escaping special characters. Otherwise readers might just
> > > think that all cases are covered in this section.
> >
> > Makes sense.  I'd actually prefer to remove the specific examples and
> > just cite reference.
> 
> Works for me.

The text in -23 was updated to read as follows:

4.1.  Encoding
[snip]
   Certain characters have special meaning in XML and MUST not appear in
   literal form.  Per Section 2.4 of [W3C.XML], these characters MUST be
   escaped with a numeric character or entity reference.

Thanks for the detailed review.

Roman