Re: [tcpinc] Eric Rescorla's Discuss on draft-ietf-tcpinc-tcpeno-13: (with DISCUSS and COMMENT)

[Eric Rescorla <[e-mail]>]

On Tue, Nov 14, 2017 at 11:18 AM, Mirja Kuehlewind (IETF) <
[e-mail]> wrote:

> Only on this point:
>
> > Am 14.11.2017 um 11:07 schrieb Eric Rescorla <[e-mail]>:
> >
> > --[3]-- IANA registry policy for TEP registry
> >
> >
> >
> > At least my suggestion of IETF Review was in part to see whether more
> strict review would be appropriate – that appears not to be the case, so …
> >
> >
> >
> > I like Amanda’s suggestion of: “Expert Review with RFC Required”   That
> should result in two security reviews of a new TEP, both of which could
> halt a weak one.  Looking at the Independent Submission track as the “path
> of least resistance” that would be the IETF Security Area (ADs and
> Directorate) as part of RFC publication plus an IANA expert review as part
> of codepoint assignment.  Thank you, Amanda.
> >
> >
> >
> > I have to admit that Ekr is right that anyone can do arbitrarily stupid
> things on their own – what we can stop is misuse of IETF’s good name and
> IANA registration in support of that sort of stupidity.
> >
> >
> > Well, ultimately this is a WG decision, but we actually have tried this
> approach in TLS and other WGs and it doesn't work well. People grab code
> points and we have to deal with that, and we also have to spend a lot of WG
> time doing useless vetting when people just want a code point.
> >
> Ekr, not sure what your recommendation is but the previous discussion was
> that it is encouraged to ask for early allocation in the (RFC) process,
> however, we would like to finally end up with a spec in an RFC for all TEPs.
>

My recommendation is not to use the IANA registry to gatekeep on what
people deploy and instead do what TLS has moved towards, namely making the
bar for registering a code point low but that have the bar to a
*recommended* code point be a standards track RFC.

As I said, it's a WG decision to decide what to do.

-Ekr


I guess if we want expert review for non-IETF stream docs it actually would
> be „IETF Review or RFC Required with Expert Review“… Amanda, does that
> still makes sense to you?
>
> Mirja
>
>