Re: [Tsv-art] Tsvart last call review of draft-ietf-perc-private-media-framework-08

On 16/02/2019, 04:08, Paul E. Jones wrote:
> Gorry,
>
> Thanks for your review.  Please see comment/questions in-line.
>
>> General comments
>>
>> Some keywords appear not defined before first used - whilst these are 
>> likely
>> to be well-known by the coimmunity of interest, it would none-the-less
>> be helpful to define these:
>>
>> SRTP; RTCP; SIP; SDP.
>
> Most of these have a reference that follows them (RTCP was the one 
> exception, I think). Are you saying we should fully state what SRTP 
> stands for, for example, or are you saying references were missing?
>
RFCs are read by people with many backgrounds for many reasons. With 
this in mind, I was just suggesting to expand the acconyms.
>
>> In section 8.1, there is a sentence starting "Off-path atttackers 
>> may" ... while this
>> is lower case, the authors may wish toi consider using "could" to 
>> remove any
>> possibility of this being regarded as permissive.
>
> Agreed. Changed as suggested.
>
>> In 8.1, the text "could incorrectly assuming their packets..." 
>> probably ought to
>> read could incorrectly assume their packets..."
>
> Thanks. Fixed that and another small grammatical error there.
>
>> In section 8.2.1. there is a dscription of a resource consumption 
>> attack, but
>> no miitigation is described. It could be possible to consider using  
>> rate-limiting
>> of requests to reduce the impact - a mthod commonly suggested in other
>> attacks on the transport endpoints
> Good point. We cannot stop this entirely, but there are certainly 
> implementation-specific approaches that could be employed.
>
> I appended that paragraph with the following:
>
> "While resource consumption attacks cannot be mitigated entirely, 
> rate-limiting packets might help reduce the effectiveness of such 
> attacks."
>
> I'm open to alternative wording, but I think that should suffice.
>
Maybe /effectiveness/ could be /impact/ ?
... I'd personally prefer to not suggest attacks are effective, but 
happy with some such words.
> Thanks,
> Paul
>
> _______________________________________________
> Tsv-art mailing list
> Tsv-art@ietf.org
> https://www.ietf.org/mailman/listinfo/tsv-art
Best wishes,

Gorry