Re: [precis] I-D Action: draft-ietf-precis-7564bis-09.txt

[Peter Saint-Andre <[e-mail]>]

On 9/17/17 2:55 PM, Peter Saint-Andre wrote:
> On 9/17/17 2:51 PM, Sam Whited wrote:
>> On Sun, Sep 17, 2017, at 15:41, Peter Saint-Andre wrote:
>>> Why would an application need to care about this? This is an internal
>>> implementation detail of a PRECIS library/API, and IMHO it would be
>>> irresponsible of the library/API author to offer an option for
>>> application developers to select how many times to apply the rules.
>>
>> That's fair, but in that case this specific profile is a special case
>> that takes a massive performance penalty even when it doesn't need too
>> (if the library author did this at all).
>>
>> My point is that we can't count on this, and there are still opinions
>> and if's in that statement. We should be trying to make this as secure
>> as possible at the spec level; regardless of what we feel might be more
>> important, if it's easier to not do this, or it incurs a big performance
>> penalty to do it some library authors probably won't.
>>
>>> Sam, I am going to reiterate that we are EXTREMELY close to publication
>>> of this document - it could have happened on, say, Thursday morning
>>> right before you posted to the list about this. Please please please
>>> either propose very specific text or point to an earlier email message
>>> where you did so, because personally I have forgotten if you already did
>>> that and my recollection from the previous discussion was that you did
>>> not raise objections to the compromise text that Bill Fisher and I
>>> agreed on. If your proposal is that we make significant changes to the
>>> document at this time, then the Working Group chair or Area Director
>>> will likely have to suggest a path forward, because your feedback is
>>> coming so very late in the process.
>>
>> I don't have a specific solution; I understand that this would require
>> reworking the Nickname profile to not use NFKD which is a huge change,
>> and that's unfortunate, but I still do not beleive it's appropriate to
>> publish this document in its current form. I voiced this opinion early
>> on, and the compormise change did nothing to address it, so I did not
>> voice it again at that time, maybe I should hvae. I am voicing the
>> feedback again now because I think the spotify article is better
>> evidence that this is a real problem than I had before.
> 
> In that case, we'll need to invoke the WG chair and/or AD.

I have forwarded this note to the chair and AD with a suitably scary
subject line. If we don't hear back from them before 8 AM Pacific time
tomorrow, I will send a similar note to the RFC Editor team to stop the
presses.

Peter