Re: [secdir] secdir review of draft-melnikov-imap-keywords-06

[Alexey Melnikov <[e-mail]>]

Samuel Weiler wrote:

> On Wed, 18 Nov 2009, Alexey Melnikov wrote:
>
>>> And for the common-use:
>>>
>>>    Registration of an IMAP keyword intended for common use (whether or
>>>    not they use the "$" prefix) requires Expert Review [RFC5226].  IESG
>>>    appoints one or more Expert Reviewer, one of which is designated as
>>>    the primary Expert Reviewer.  IMAP keywords intended for common use
>>>    SHOULD be standardized in IETF Consensus [RFC5226] documents. ...
>>>    In cases when an IMAP
>>>    Keyword being registered is already deployed, Expert Reviewers
>>>    should favour registering it over requiring perfect documentation.
>>>
>>> Would it be better to say: "requires either IETF Consensus or Expert 
>>> Review"?
>>
>> Not everybody is subscribed to ietf or ietf-announce mailing lists, 
>> so I would like for all common use registrations to go through the 
>> expert.
>
> I don't like the logic (while not everybody is subscribed to the 
> lists, your expert surely could be,

People have complained about traffic on the ietf mailing list during 
plenaries.

> and it's easy from an AD to punt the doc to the expert).

That part is easy, yes.

> That said, since you want everything to go through the expert, to 
> avoid confusion, I suggest removing the citation to the inapplicable 
> 5226 metric: "IETF Consensus [RFC5226]".

Ok, I will try to clarify.

>>> (For example: do the registrations made in this doc have to go 
>>> through Expert Review?
>>
>> No, because they are a part of the document that creates the registry 
>> ;-).
>>
>>> Isn't it enough to have them in a consensus doc?")  And how do you 
>>> expect the expert to encourage/enforce the SHOULD, given the "favour 
>>> registering it over requiring perfect documentation" guideline?  
>>> Again, the current text isn't as clear as I'd like.
>>
>> This is intentional. This is a judgment call by the expert.
>
> This sounds inconsistent.

Yes, but it is a fact of life. It is not worse than the current 
situation where people just deploy stuff without bring it to any 
standard mailing list.

> I'm hearing "it's within the scope of the expert's judgement to 
> require an IETF Consensus doc" and "In cases when an IMAP Keyword 
> being registered is already deployed, Expert Reviewers should favour 
> registering it over requiring perfect documentation."  If I were an 
> implementer who got told "you need a consensus doc", I'd be more than 
> a little tempted to go ahead and deploy, then reapply for the 
> registration.

Well, if one works for Microsoft, Google, Mozilla, etc. (not trying to 
pick on anybody), then one does it every time.
Hopefully Expert Review is low enough bar to tempt people (if tempt is 
the right word here at all) to register.