Re: [mile] some comments on the xmpp-grid draft

["Nancy Cam-Winget (ncamwing)" <[e-mail]>]

Hi Takeshi,
Many thanks for providing these comments!  Please see further responses below:

On 10/3/18, 22:06, "mile on behalf of Takeshi Takahashi" <[e-mail] on behalf of [e-mail]> wrote:

    Hello authors of draft-appala-mile-xmpp-grid,
    
    Before working on the shepherd-writeup, there are several issues I (as an
    individual without any hat) would like to comment on.
    I know that the WG last call has already completed, but hopefully you could
    consider reflecting these comments.
    These comments are more-or-less editorial.
    
    1. Current xmpp-draft talks about the delivery of only IODEF document, but
    the charter will be changed so that MILE transport protocols can deliver not
    only IODEF documents but also various security-related information
    (currently, the charter is under review by our AD). Moreover, by reading the
    draft, I could not find any IODEF-specific definitions. Therefore, wouldn't
    it be better to change the sentences so that xmpp-grid can deliver not only
    IODEF documents but also various security-related information, including
    STIX documents?
[NCW] True, as our charter grows we can demonstrate how other namespaces 
can be used.  I am not sure the draft is restricted to only IODEF, though it uses
that as the (or one) example for how security information can be shared using
XMPP.  I think the only normative aspect to IODEF is its use and reference in namespace.
I am amenable to making it wider, but I think the only suitable place could be in
The introduction.  I could add a sentence at the end to state "While many other
Security information formats can be shared using XMPP, this document 
uses IODEF as one such exchange format that can be published
And consumed using XMPP."
Would that satisfy this comment?
    
    2. The document is intended to be a Standard-track RFC. Readers of the
    current draft may think it is a draft designed to be an Informational RFC
    because it is not clear to the readers what is newly defined in this
    document. The document could be seen as a guidancde on how to use
    XMPP-related techniques. Therefore, these new definitions should be
    addressed in the introduction section. In my understanding, the three
    values, i.e., disco#items, disco#info, and pubsub#type, were newly defined
    in this document.
    [NCW] Ah yes, we had discussed this but never concluded as to whether it is
Standards or informational.  The reference to the use of the IODEF namespace
May allow this to be standards track; but in general, it is more of a guidance document
So we could make this an informational draft. 

    3. The terminology definition sentences begin with "In SACM", but I think we
    can omit that part of the sentences.
[NCW]  Will do.
    
    4. We could delete the defitions of "Publisher", "Publish-Subscribe
    Service", and "Subscriber" from the Terminology definition section, because
      - these terms are not used in this document, and 
      - you have already said that "Provider", "Broker", and "Consumer" are the
    terms that us used within this document for them
[NCW]  Will do.
    
    5. in section 3 "Architecture", there is a sentence: "Platforms cannot ...
    and relationships (e.g., Provider or Consumer) at the Broker.
    Is it correct to read like this: "Platforms cannot ... and relationships
    among entities, (e.g., Provider or Consumer) at the Broker" ?
[NCW] Actually they have to obtain the appropriate authorization to either or both
Be a provider or consumer; the authorization is done thru the broker.  I will clean that 
Sentence; somehow it got munged in version 4 of the draft.
    
    6. in the same sentence discussed above, you have written "(e.g., Provider
    or Consumer)". However, are there indeed any other entities other that
    Provider and Consuer? If not, we could change it to "(i.e., Provider or
    Consumer)
[NCW] Actually, a platform can be a provider for some formats (say IODEF) and
A consumer of others (say STIX or some other namespaces).  But in general,
There are only providers and consumers.
    
    7. In section 3 "Architecture", "thru"->"through"
[NCW] Thanks, will update.
    
    8. in Section 4 (workflow), "Controller (XMPP server)" -> "Controller"
       Because you have already defined the term (and because you have already
    clarified that these terms are equivalent), I am not sure whether we need
    both terms listed here or not.
[NCW] Fair point.
    
    9. you have a term "Topic". In section 2, Topic is defined to be a channel,
    but in other places, it seems to be treated as a data or information.
      - ex1: "A Provider unicasts its Topic updates to the Grid.... The Broker
    handles replication and distribution of the Topic to Consumers"
      - ex2: "discover thbe available information (Topics) to be published or
    Consumes
[NCW] I will have to go through and ensure they are consistant.  A Topic
Is a type of information (effectively a namespace).
    
    10. in item f of section 4, I am not sure whether "as" in  "and as Consumers
    will then receive ... " is a typo or not. Would it be "the" or something
    else?
    
    11. in item f of section 4, "from the Topics to which it is subscribed"
    could be "from the Topics to which they subscribe" ???
[NCW] How about:
Any Platform on the Grid may subscribe to any Topics published to
       the Grid (as permitted by authorization policy), and (as
      Consumers) will then receive a continuous, real-time stream of
       updates from the Topics to which they are subscribed.
    
    12, in section 4, "(Topics) to bepublished or consumes" -> "(Topics) to
    bepublished or consumed"
[NCW] Thanks for catching this....will update
    
    13. in section 5: I believe this section is the basis for making this draft
    a standard track RFC. The draft seems to be defining these three
    values---disco#items, disco#info, and pubsub#type.
        If it is newly defined in this draft, I hope the authors could say so
    somewhere in this draft. Or, is it defined elsewhere?
[NCW] No, these are extended XMPP constructs in XEP-0030, but I think for the "Grid"
To allow for service discovery, XEP-0030 SHOULD be implemented
And for asynchronous sharing XEP-0060 MUST be implemented.  So these
I also thought is what made it standard or stronger than a guidance.
    
    14. Sectuion 8 "Security Considerations" have lots of information. I am
    wondering which of these are issues brought by the original xmpp and which
    of these are newly added issues brought by xmpp-grid.
        If there are already existing texts on the security considerations of
    xmpp, referencing these text would be helpful.
[NCW] These are all new considerations we believed are needed beyond what is 
Defined in the XMPP RFC's as they go to the establishment of the "Grid"
and the communications between the consumers and producers.
    
    Kind regards,
    Take
    
    
    _______________________________________________
    mile mailing list
    [e-mail]
    https://www.ietf.org/mailman/listinfo/mile