[ppsp] Stephen Farrell's Discuss on draft-ietf-ppsp-base-tracker-protocol-10: (with DISCUSS and COMMENT)

["Stephen Farrell" <[e-mail]>]

Stephen Farrell has entered the following ballot position for
draft-ietf-ppsp-base-tracker-protocol-10: Discuss

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)


Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.


The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-ppsp-base-tracker-protocol/



----------------------------------------------------------------------
DISCUSS:
----------------------------------------------------------------------


6.2 - can you explain to me how the overall protection
against pollution works? I'm not quite following it and am
concerned that it may be lacking. But that may just be me
forgetting how this ties together with rfc7574.


----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

- I-D nits notes a bunch of missing reference entries, e.g.
for RFC6972 as well as 6 others. Probably some xml2rfc
issue.

- intro: last para (just before 1.1) puzzles me. Not sure
why it''s there.

- intro: why is there no mention of Bit Torrent? This seems
to be the same design for the same purpose, and BT is in
widespread use so not explaining the relationship seems a
bit odd. 5.1.2 seems to be plain silly in that light, while
BT is not a "standard" that is irrelevant - it has been
widely deploy and migration from BT to this, or
co-existence, would seem critical to the success of this
effort.

- RFC2616 is obsoleted.

- 6.1: I agree with Katheen's discuss, a MUST use TLS is
needed here really and just reflects reality and is not an
additioanl consideration. It is needed for clarity though.

- 6.2: Given the history of spoofing in BT I wondered why
there is no object level origin auth defined here. 

- I also agree with Ben's discuss.