[mile] Alexey Melnikov's Discuss on draft-ietf-mile-rfc5070-bis-22: (with DISCUSS and COMMENT)

["Alexey Melnikov" <[e-mail]>]

Alexey Melnikov has entered the following ballot position for
draft-ietf-mile-rfc5070-bis-22: Discuss

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)


Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.


The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-mile-rfc5070-bis/



----------------------------------------------------------------------
DISCUSS:
----------------------------------------------------------------------

I will move to yes when the following issue is discussed.

Robert Sparks' SecDir review reminded me: I am concerned by the
requirement to automatically download updates from IANA. If many devices
or software programs implement IODEF and start doing schema validation,
this can cause DDoS attack on IANA infrastructure.


----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

In 3.29.3.1: there is still a reference to RFC 822 (should be RFC 5322)

In 4.1: it would be good to point to the W3C XML document about rules for
escaping special characters. Otherwise readers might just think that all
cases are covered in this section.