Re: [secdir] Secdir last call review of draft-ietf-extra-imap-list-metadata-01

[Ken Murchison <[e-mail]>]

Hi Yoav,

Yes, you are absolutely correct.  That was an oversight on my part and 
has been corrected in my working copy.


On 3/10/24 6:30 PM, Yoav Nir via Datatracker wrote:
> Reviewer: Yoav Nir
> Review result: Has Nits
>
> I have reviewed this document as part of the security directorate's ongoing
> effort to review all IETF documents being processed by the IESG.  These
> comments were written primarily for the benefit of the security area directors.
> Document editors and WG chairs should treat these comments just like any other
> last call comments.
>
> The document is short and well-written. The security considerations section is
> also short enough for me to copy it here:
>
>     This specification does not introduce any additional security
>     concerns beyond those described in [RFC5258].
>
> RFC5258 is the RFC that describes LIST extensions in general. However, this
> document does not just describe a generic extension. It describes an extension
> to make the LIST command response contain the mailbox metadata. RFC 5464 which
> describes mailbox metadata has a Security Considerations section, and its
> content applies here.  So I suggest to replace "those described in [RFC5258]."
> with "those described in [RFC5258] and [RFC5464]."
>
>
-- 
Kenneth Murchison
Senior Software Developer
Fastmail US LLC