Re: [secdir] secdir review of draft-ietf-alto-protocol

["Y. Richard Yang" <[e-mail]>]

Dan, Richard A.

On Mon, Feb 17, 2014 at 4:10 PM, Richard Alimi <[e-mail]> wrote:
>
>
> On Mon, Feb 17, 2014 at 6:26 AM, Dan Harkins <[e-mail]> wrote:
>
>>
>>   Hi Richard,
>>
>> On Sun, February 9, 2014 10:58 pm, Richard Alimi wrote:
>> > Thank you very much for the review!
>> >
>> > Responses inline...
>> >
>> >
>> > On Sat, Feb 1, 2014 at 10:54 AM, Dan Harkins <[e-mail]>
>> wrote:
>> >
>> >>
>> [snip]
>> >>   - 6.1.2, while a particular Cost Map may contain only one of the
>> >>      two cost modes, servers MUST implement support for both,
>> >>      right? It's not clear from the text.
>> >>
>> >
>> > Servers only need to implement at least one, but not necessarily both.
>> >  Section 6.1.2 states the following:
>> >
>> >
>> >    An ALTO Server MUST support at least one of 'numerical' and 'ordinal'
>> >    modes.
>> >
>> >
>> > Can you suggest which text was misleading so that we can address it?
>>
>>   It's not clear to me how this interoperates unless it's possible to
>> infer
>> one from the other and if that's the case then why are there two things
>> to choose to support?
>>
>
> The key is that the client needs to handle both types, not the server.
>  During working group discussions, it was not clear that a server would
> always wish to provide both and may opt to expose one or the other.
>
> For example, one cited reason for a server not exposing numerical costs
> was concerns over revealing too many details of internal network topology.
>
> It is possible to derive ordinal costs from numerical costs.  Thus, we
> could require servers to provide ordinal costs and optionally provide
> numerical costs.  We opted to put this logic in the client-side, though, in
> the interest of keeping the server simpler.
>
> Richard/Reinaldo: do you believe this is still a reasonable tradeoff and
> am I missing any other rationale for this?  I'm typically on the side of
> keeping servers simpler, but we could reconsider if necessary.
>

I remember extensive discussions on the two modes. Given the dependency
between the numerical and the ordinal modes (one can derive the ordinal
from numerical but not the other way around), we can say that the ordinal
mode is always provided, either implicitly (only numerical) or explicitly
(when both are provided). This will allow interop.

At the same time, the discussion was that we do not enforce the explicit
approach to keep the Server simple, as Richard A. mentioned. Also, the less
redundancy at the source (maintaining both numerical and ordinal), the less
likely we encounter inconsistency.

Richard