[secdir] Re: SECDIR review of draft-ietf-emailcore-rfc5321bis-42

[John C Klensin <[e-mail]>]

(sorry -- hit "send" too soon.  One additional comment below.)

Donald,

Thanks for the careful reading.  All of these seem appropriate for
action by the RPC (one or two stylistic issues that may require
discussion with them) rather than anything security-specific as
called for in the now-closed recent Last Call.

FWIW and while nits are being picked, like at least one of its
predecessors, this review was posted many hours after the
notification from the datatracker that the Last Call had closed. 

No idea where the first one listed came from, but presumably some
sort of pasting error -- corrections made in the working version of
the RFCXML file.

The use of "in principle" appears, in both of the contexts you
observed, in RFC 5321 and the first usage is in RFC 2821.  Changing
it interacts with "minimal change" principle established by the WG
and its charter.  Independent of that procedural issue, the phrasing
was used in 2008 and earlier to indicate that the changes to code
definitions referred to in 4.3.2 and the possible separate registries
referred to in 8.1.4 would be bad ideas under any circumstances the
WG could determine.  While "in principle" is, in a way, hand waving,
the alternative would have been to say, explicitly, something like
"we don't want to prohibit that possibility, but any attempt to do it
should be scrutinized very carefully" or a normative "such things
SHOULD NOT be done".   The experience in 2007-2008 and predictions
from several of the comments made during the review of 5321bis
strongly suggests that anything appearing to be a statement along
those lines would produce demands to spell out the circumstances
under which such actions should be allowed or prohibited, something
the WG could not do because those circumstances cannot be foreseen.
So, "in principle" appeared to be, not useless noise as your note
implies, but a deliberate, least-bad, choice.

thanks again,
   john


--On Friday, April 4, 2025 14:15 -0400 Donald Eastlake
<[e-mail]> wrote:

> I have reviewed this document as part of the security directorate's
> ongoing effort to review all IETF documents being processed by the
> IESG. Document editors and WG chairs should treat these comments
> just like any other last call comments.
> 
> The summary of the review is Ready with nits.
> 
> This is a re-review for version -42. I previously reviewed versions
> -38 and -32 of this draft.
> 
> All good enough except for a few nits.
> 
> Nits:
> 
> When I look at Section 4.1.1.3, I see three unknown character
> glyphs: two right after the end of the 1st sentence in the 2nd
> paragraph and one between "destination" and "mailbox" later in that
> paragraph.
> 
> Section 8.1.1.3, 2nd paragraph, 1st sentence, "is required" -> "are
> required"
> 
> Section 8.1.1.3, item (1), "non terminal" -> "nonterminal"
> 
> Section 8.1.1.3, item (2), "a server and client  SMTP" -> "an SMTP
> server and client"
> 
> Suggest deleting both occurrences of "in principle". Either
> something applies or it doesn't. Asserting something qualified by
> "in principle" does not seem useful.
> 
> 
> Thanks,
> Donald
> ===============================
>  Donald E. Eastlake 3rd   [phone] (cell)
>  2386 Panoramic Circle, Apopka, FL 32703 USA
>  [e-mail]