Re: [secdir] SECDIR Review of draft-ietf-repute-model-08

["Murray S. Kucherawy" <[e-mail]>]

Hi Donald, thanks for your comments.  Replies inline.

On Tue, Sep 3, 2013 at 7:36 PM, Donald Eastlake <[e-mail]> wrote:

> Minor Problems:
>
> Section 1:
>   The last sentence of the first paragraph could be read to imply that
> lack of authentication is the primary cause of spam. In this era of
> botnets, I don't think that's true. Perhaps "... leads to spam,
> phishing, and other attacks." should say "... makes spam, phishing,
> and other attacks even easier than they would otherwise be." or
> something like that.
>

OK.

Section 4.1.1:
>   My guess is that the values of a "Rating" are floating point in the
> range 0.0 to 1.0 but it doesn't actually say that... If so, why isn't
> the example "1.0" said to indicate "exact agreement" or the like
> instead of "strong agreement"? Would 2.0 indicate "very strong
> agreement".
>

Right, the range is actually spelled out in the media-type document, where
ABNF is provided.  I'll add that here as well.


> Section 5:
>   This section seems in some ways like the heart of the document but
> is also seems a bit blurry. Even at a high level, I would think that
> there could be an explicit cardinality associated with these bullet
> items. That is, it should say for each (or for all in the case it is
> the same for all of them) if they can be omitted, whether or not they
> must occur at least once, and if they can occur multiple times.
>

I've added "at least the following data" since a basic response will
include all of those.  Additional values might be present in a response
within a given application space.  This is spelled out more normatively in
the media-type document.


>   Is "application context" the same as what quality is being rated? I
> would think not. For example, couldn't the application be "restaurant
> recommendation" and then couldn't there be, say, four ratings, one for
> food quality, one for price, one for decor, and one for service? If
> so, why isn't what the rating measures an additional bullet item or
> part of the rating score item? On the other hand, the rating score
> item says "overall rating score" implying there can only be one...
>

In your hypothetical example, the application context would be
"restaurant", and the assertions possible would be "food-quality", "price",
"decor", and "service".  A different rating would be returned for each of
those, as requested by the client.


>
> Section 6:
>   Suddenly, in this section, for the first time, we have the
> capitalized word "Target". Why isn't this defined in Section 4 on
> terminology and definitions? I suppose it means something like the
> pair of identity of the entity being rated and the application
> context?
>

We don't use "Target" anywhere else, but rather use "subject", so I've
changed it to that and de-capitalized all of them.  There's no need to
introduce a new term so late in the document.


> Trivia:
>
> Section 1:
>   In paragraph 3 the definition of "reputation" uses the word
> "estimation" in an uncommon way that might confuse some readers. I
> think it could use something like the word "esteem" instead. The word
> "opinion" could also be used but would require minor corresponding
> changes. This occurs within quoted text that looks like it is copied
> from somewhere else. If so, shouldn't that source be referenced?
>

I got it from a dictionary, namely
http://dictionary.reference.com/browse/reputation. It looks like that's
based on the 2013 Random House dictionary.  I'll add a citation.


>
> Section3:
>   The Figure 1 footer should be on the same page as the figure.
>

Is there a way to force that in xml2rfc?


>
> Section 4.1:
>   In the last sentence of the 2nd paragraph at the end of page 7, I
> would strongly prefer "specify" to "define" but that might be a
> personal quirk.
>

Done.

Thanks again,

-MSK