Re: ietf-nntp My notes from the NNTP WG meeting at the 37th IETF

[Keith Moore <[e-mail]>]

> There is a short unwritten list of things which all IETF protocols need to 
> address before they go standards track.  

the details aren't nailed down anywhere, which means there's some
flexibility in interpretation...

>   * Strong Authentication

Meaning (at least) you don't send passwords in the clear.

IMHO, NNTP is quite useful without any authentication.  So I would
consider it acceptable to promote NNTPbis on the standards track
without any kind of authentication; the authentication could be in a
separate extension.

Alternatively, the NNTP wg could define a new auth method.  But the
group should not deviate too much from documenting current practice,
because it needs (at least for now) to avoid the temptation to define
all kinds of new things.

Offhand I'd say that if AUTHINFO USER/PASS goes in there, then you
need to explicitly discourage it, require it to be disabled by
default, etc, and have a better auth flavor defined also.  Or you can
leave it out of the base spec entirely and call it an extension.

Keep in mind the intent: 

a. document what people need to know to write a good NNTP client or
server implementation that interoperates with the installed base

b. discourage bad practices like cleartext passwords.  sometimes to
discourage a bad practice, you have to offer a better alternative.


>   * Internationalization (just use ISO-8859-1 doesn't count)

Most I18N issues are out of scope for NNTP.  I18N does need to be
addressed in son-of-1036 (i.e. just use MIME).  

As for I18N in NNTP:

+ NNTPbis should probably be speced to be 8-bit clean.

+ Given current news practice to use different charsets in different
hierarchies, the group might want to consider whether to add some NNTP
command that lets a client learn the default charset for a particular
newsgroup.  (in the absence of MIME labelling)

but that's all that comes to mind.

Keith