[secdir] Re: SECDIR review of draft-ietf-emailcore-rfc5321bis-42

[Donald Eastlake <[e-mail]>]

Hi John,

On Fri, Apr 4, 2025 at 3:29 PM John C Klensin <[e-mail]> wrote:
>
> Donald,
>
> Thanks for the careful reading.  All of these seem appropriate for
> action by the RPC (one or two stylistic issues that may require
> discussion with them) rather than anything security-specific as
> called for in the now-closed recent Last Call.
>
> FWIW and while nits are being picked, like at least one of its
> predecessors, this review was posted many hours after the
> notification from the datatracker that the Last Call had closed.

I did a SECDIR review based on the review request that was dispatched to me at
https://datatracker.ietf.org/doc/draft-ietf-emailcore-rfc5321bis/reviewrequest/21841/
It just says that the deadline is today and, while it is a SECDIR
review request, it says nothing about comments being limited to
security specific comments.

> No idea where the first one listed came from, but presumably some
> sort of pasting error -- corrections made in the working version of
> the RFCXML file.
>
> The use of "in principle" appears, in both of the contexts you
> observed, in RFC 5321 and the first usage is in RFC 2821.  Changing
> it interacts with "minimal change" principle established by the WG
> and its charter.  Independent of that procedural issue, the phrasing
> was used in 2008 and earlier to indicate that the changes to code
> definitions referred to in 4.3.2 and the possible separate registries
> referred to in 8.1.4 would be bad ideas under any circumstances the
> WG could determine.  While "in principle" is, in a way, hand waving,
> the alternative would have been to say, explicitly, something like
> "we don't want to prohibit that possibility, but any attempt to do it
> should be scrutinized very carefully" or a normative "such things
> SHOULD NOT be done".   The experience in 2007-2008 and predictions

"in principle" and "scrutinized very carefully" are both vague. If you
can't think of any type of reason for people to do it, then just say
MUST NOT and be done with it. If something does come up, as is always
possible for anything, this can be changed by later RFCs.

Thanks,
Donald
===============================
 Donald E. Eastlake 3rd   [phone] (cell)
 2386 Panoramic Circle, Apopka, FL 32703 USA
 [e-mail]

> from several of the comments made during the review of 5321bis
> strongly suggests that anything appearing to be a statement along
> those lines would produce demands to spell out the circumstances
> under which such actions should be allowed or prohibited, something
> the WG could not do because those circumstances cannot be foreseen.
> So, "in principle" appeared to be, not useless noise as your note
> implies, but a deliberate, least-bad, choice.
>
> thanks again,
>    john
>
>
> --On Friday, April 4, 2025 14:15 -0400 Donald Eastlake
> <[e-mail]> wrote:
>
> > I have reviewed this document as part of the security directorate's
> > ongoing effort to review all IETF documents being processed by the
> > IESG. Document editors and WG chairs should treat these comments
> > just like any other last call comments.
> >
> > The summary of the review is Ready with nits.
> >
> > This is a re-review for version -42. I previously reviewed versions
> > -38 and -32 of this draft.
> >
> > All good enough except for a few nits.
> >
> > Nits:
> >
> > When I look at Section 4.1.1.3, I see three unknown character
> > glyphs: two right after the end of the 1st sentence in the 2nd
> > paragraph and one between "destination" and "mailbox" later in that
> > paragraph.
> >
> > Section 8.1.1.3, 2nd paragraph, 1st sentence, "is required" -> "are
> > required"
> >
> > Section 8.1.1.3, item (1), "non terminal" -> "nonterminal"
> >
> > Section 8.1.1.3, item (2), "a server and client  SMTP" -> "an SMTP
> > server and client"
> >
> > Suggest deleting both occurrences of "in principle". Either
> > something applies or it doesn't. Asserting something qualified by
> > "in principle" does not seem useful.
> >
> >
> > Thanks,
> > Donald
> > ===============================
> >  Donald E. Eastlake 3rd   [phone] (cell)
> >  2386 Panoramic Circle, Apopka, FL 32703 USA
> >  [e-mail]
>
>