[OAUTH-WG] John Scudder's No Objection on draft-ietf-oauth-resource-metadata-11: (with COMMENT)

[John Scudder via Datatracker <[e-mail]>]

John Scudder has entered the following ballot position for
draft-ietf-oauth-resource-metadata-11: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)


Please refer to https://www.ietf.org/about/groups/iesg/statements/handling-ballot-positions/ 
for more information about how to handle DISCUSS and COMMENT positions.


The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-oauth-resource-metadata/



----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Thanks for the well-written document. I have a couple of comments —

- Section 1 “This use of WWW-Authenticate can indicate that the protected
resource metadata MAY have changed.” That’s a misuse of the RFC 2119 MAY. You
aren’t specifying procedure here, so you should be using lowercase “may”. This
recurs in Section 5.2, “its metadata MAY have changed”.

- In Section 8, you say the registration policy is Specification Required, but
then you go on to say “However, to allow for the allocation of values prior to
publication, the Designated Experts may approve registration once they are
satisfied that such a specification will be published.” As far as I can tell,
that is not compatible with the plain language of the policy called
“Specification Required“ as described in RFC 8126. I also wonder how the
experts could possibly do a proper review if all they have to look at is an IOU
for a specification.