Review of draft-ietf-mmusic-sap-v2-01.txt

[Dave Thaler <[e-mail]>]

Review of draft-ietf-mmusic-sap-v2-01.txt

The abstract and introduction specifically say that SAP is
implemented by _clients_.  My understanding is that in the
original framework, and in what the authors envision as a "good" solution,
SAP is actually implemented by _servers_, and you have a separate
mechanism to communicate between clients and servers (if they
are implemented as separate processes, unlike sdr).

If we support SAP, it will likely be on servers not clients (there's 
already a diagram in MSDN showing this), and I know there's been talk among 
the spec authors that sdr ought to change to do this as well.  Hence, 
I would like to see both the abstract and the introduction changed to 
reflect that current practice is not best practice, and that SAP is 
actually intended for server-server communication.  Section 10 is 
not sufficient to address my concern.

The rest of the draft after the intro looks fine in this regard
since it just uses "SAP announcer" etc except for the first
bullet item of appendix B which refers to "SAPv1 clients"
and should be "SAPv1 listeners" or some such term.


Regarding Authentication Header... why is this used instead of
IPsec AH (as the MZAP, etc specs use)?  I would have expected
to see a discussion of this somewhere (Security Considerations
at least), since doing per-protocol security is less secure in
the sense that you now have to worry about two implementations
(IPsec's and SAP's).


The rest of the spec looks fine to me.

-Dave