Re: [secdir] secdir review of draft-melnikov-imap-keywords-06

Alexey Melnikov <> Sat, 28 November 2009 21:30 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 4E0F83A6932; Sat, 28 Nov 2009 13:30:46 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -2.552
X-Spam-Status: No, score=-2.552 tagged_above=-999 required=5 tests=[AWL=0.047, BAYES_00=-2.599]
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id qz1tj2f3chyB; Sat, 28 Nov 2009 13:30:45 -0800 (PST)
Received: from ( []) by (Postfix) with ESMTP id 365C13A6930; Sat, 28 Nov 2009 13:30:45 -0800 (PST)
Received: from [] ( []) by (submission channel) via TCP with ESMTPA id <>; Sat, 28 Nov 2009 21:30:38 +0000
Message-ID: <>
Date: Sat, 28 Nov 2009 21:29:46 +0000
From: Alexey Melnikov <>
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.12) Gecko/20050915
X-Accept-Language: en-us, en
To: Samuel Weiler <>
References: <> <> <>
In-Reply-To: <>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Subject: Re: [secdir] secdir review of draft-melnikov-imap-keywords-06
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Security Area Directorate <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Sat, 28 Nov 2009 21:30:46 -0000

Samuel Weiler wrote:

> On Wed, 18 Nov 2009, Alexey Melnikov wrote:
>>> And for the common-use:
>>>    Registration of an IMAP keyword intended for common use (whether or
>>>    not they use the "$" prefix) requires Expert Review [RFC5226].  IESG
>>>    appoints one or more Expert Reviewer, one of which is designated as
>>>    the primary Expert Reviewer.  IMAP keywords intended for common use
>>>    SHOULD be standardized in IETF Consensus [RFC5226] documents. ...
>>>    In cases when an IMAP
>>>    Keyword being registered is already deployed, Expert Reviewers
>>>    should favour registering it over requiring perfect documentation.
>>> Would it be better to say: "requires either IETF Consensus or Expert 
>>> Review"?
>> Not everybody is subscribed to ietf or ietf-announce mailing lists, 
>> so I would like for all common use registrations to go through the 
>> expert.
> I don't like the logic (while not everybody is subscribed to the 
> lists, your expert surely could be,

People have complained about traffic on the ietf mailing list during 

> and it's easy from an AD to punt the doc to the expert).

That part is easy, yes.

> That said, since you want everything to go through the expert, to 
> avoid confusion, I suggest removing the citation to the inapplicable 
> 5226 metric: "IETF Consensus [RFC5226]".

Ok, I will try to clarify.

>>> (For example: do the registrations made in this doc have to go 
>>> through Expert Review?
>> No, because they are a part of the document that creates the registry 
>> ;-).
>>> Isn't it enough to have them in a consensus doc?")  And how do you 
>>> expect the expert to encourage/enforce the SHOULD, given the "favour 
>>> registering it over requiring perfect documentation" guideline?  
>>> Again, the current text isn't as clear as I'd like.
>> This is intentional. This is a judgment call by the expert.
> This sounds inconsistent.

Yes, but it is a fact of life. It is not worse than the current 
situation where people just deploy stuff without bring it to any 
standard mailing list.

> I'm hearing "it's within the scope of the expert's judgement to 
> require an IETF Consensus doc" and "In cases when an IMAP Keyword 
> being registered is already deployed, Expert Reviewers should favour 
> registering it over requiring perfect documentation."  If I were an 
> implementer who got told "you need a consensus doc", I'd be more than 
> a little tempted to go ahead and deploy, then reapply for the 
> registration.

Well, if one works for Microsoft, Google, Mozilla, etc. (not trying to 
pick on anybody), then one does it every time.
Hopefully Expert Review is low enough bar to tempt people (if tempt is 
the right word here at all) to register.