Re: [secdir] secdir review of draft-melnikov-imap-keywords-06

Alexey Melnikov <alexey.melnikov@isode.com> Wed, 18 November 2009 08:17 UTC

Return-Path: <alexey.melnikov@isode.com>
X-Original-To: secdir@core3.amsl.com
Delivered-To: secdir@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 501E63A68A0; Wed, 18 Nov 2009 00:17:26 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.599
X-Spam-Level:
X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RMogWQK8XUwJ; Wed, 18 Nov 2009 00:17:25 -0800 (PST)
Received: from rufus.isode.com (rufus.isode.com [62.3.217.251]) by core3.amsl.com (Postfix) with ESMTP id DC33D3A6893; Wed, 18 Nov 2009 00:17:24 -0800 (PST)
Received: from [92.40.113.136] (92.40.113.136.sub.mbb.three.co.uk [92.40.113.136]) by rufus.isode.com (submission channel) via TCP with ESMTPA id <SwOtjgAJma7k@rufus.isode.com>; Wed, 18 Nov 2009 08:17:19 +0000
Message-ID: <4B03AD81.9090103@isode.com>
Date: Wed, 18 Nov 2009 08:17:05 +0000
From: Alexey Melnikov <alexey.melnikov@isode.com>
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.12) Gecko/20050915
X-Accept-Language: en-us, en
To: Samuel Weiler <weiler@watson.org>
References: <alpine.BSF.2.00.0911091524400.76090@fledge.watson.org>
In-Reply-To: <alpine.BSF.2.00.0911091524400.76090@fledge.watson.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Cc: secdir@ietf.org, ietf@ietf.org
Subject: Re: [secdir] secdir review of draft-melnikov-imap-keywords-06
X-BeenThere: secdir@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Security Area Directorate <secdir.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/secdir>, <mailto:secdir-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/secdir>
List-Post: <mailto:secdir@ietf.org>
List-Help: <mailto:secdir-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/secdir>, <mailto:secdir-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 18 Nov 2009 08:17:26 -0000

Hi Samuel,
Thank you for the review.

Samuel Weiler wrote:

> I have reviewed this document as part of the security directorate's 
> ongoing effort to review all IETF documents being processed by the 
> IESG.  These comments were written primarily for the benefit of the 
> security area directors.  Document editors and WG chairs should treat 
> these comments just like any other last call comments.
>
> From a security perspective, I have no issues with this document. It 
> creates a new registry and defines two sets of assignment metrics, one 
> for "common use" keywords, and one for vendor-specific keywords.
>
> It also registers four keywords.  (I'm wondering if it shouldn't be 
> registering more.)

Further registrations will be done by the designated expert. I am 
concerned that if I put all of them in the document, then the document 
will never finish.

> I'm finding the IANA assignment metrics to be a little more ambiguous 
> that I'd like.
>
> Starting with the vendor-specific text:
>
>    Registration of vendor specific IMAP keywords is done on First Come
>    First Serve [RFC5226] basis and doesn't require the Expert Review.
>    However such review is still encouraged.  Should the review be
>    requested, ...
>
> Who requests the review?

> The registrant or IANA?

Good question. I was thinking about the registrant. But IANA requesting 
review would be a good idea as well.

> Does IANA need to encourage the review?  Perhaps it would be better to 
> have all requests (including vendor-specific) be sent to the mailing 
> list, with IANA assignment of the vendor-specific ones being automatic 
> following a (short) delay for comment and optional revision.

Ok, I've implemented this procedure in my copy.

> And for the common-use:
>
>    Registration of an IMAP keyword intended for common use (whether or
>    not they use the "$" prefix) requires Expert Review [RFC5226].  IESG
>    appoints one or more Expert Reviewer, one of which is designated as
>    the primary Expert Reviewer.  IMAP keywords intended for common use
>    SHOULD be standardized in IETF Consensus [RFC5226] documents. ...
>    In cases when an IMAP
>    Keyword being registered is already deployed, Expert Reviewers
>    should favour registering it over requiring perfect documentation.
>
> Would it be better to say: "requires either IETF Consensus or Expert 
> Review"?

Not everybody is subscribed to ietf or ietf-announce mailing lists, so I 
would like for all common use registrations to go through the expert.

> (For example: do the registrations made in this doc have to go through 
> Expert Review?

No, because they are a part of the document that creates the registry ;-).

> Isn't it enough to have them in a consensus doc?")  And how do you 
> expect the expert to encourage/enforce the SHOULD, given the "favour 
> registering it over requiring perfect documentation" guideline?  
> Again, the current text isn't as clear as I'd like.

This is intentional. This is a judgment call by the expert.