[Tzdist] eliot review of draft-ietf-tzdist-service

[Eliot Lear <[e-mail]>]

Major issues:

Security & privacy considerations must be addressed.  That doesn't mean
we have to accept every aspect of Daniel's review, but we certainly do
need to address them.

Section 8:
>
>    Clients that support transport layer security as defined by [RFC2818]
>    SHOULD try the "_timezones" service first before trying the
>    "_timezone" service.  Clients MUST follow the certificate
>    verification process specified in [RFC6125].

This poses a downgrade attack.  What I thought we had agreed was that we
wanted was that servers MUST implement timezones, and MAY implement
both; clients SHOULD use timezones, but MAY instead query timezone.  But
they should choose one and use it, processing an error if no service is
available.

Minor Issues:

In Section 2, as far as this protocol is concerned, is there any
architectural difference between Root Providers and Secondary
Providers?  If not, we should should say so.  I'm tempted to suggest
combining them, as well.

Section 3.9:
>    When truncating the start of a "VTIMEZONE" component, the server MUST
>    include either a "STANDARD" or "DAYLIGHT" sub-component with a
>    "DTSTART" property value that matches the start point of the
>    truncation range, and appropriate "TZOFFSETFROM" and "TZOFFSETTO"
>    properties to indicate the correct offset in effect right before and
>    after the truncation range start point.

Very minor: do you mean an OR or an exclusive OR above.  If you mean the
former, I would suggest replacing the word "either" with "at least one
of".  If you mean an exclusive or, then I would suggest replacing
"either" with "exactly one".

Section 4.2.1.2 & 4.2.1.3

Is there a need for both of these mechanisms?


Nits:

In the next version the following text should either have its tense
changed or be removed:

>    Discussion of this document should take place on the tzdist working
>    group mailing list <[e-mail]>rg>.

Section 2:
>    (a) Contributors:  Individuals, governments or organizations which
>       provide information about time zones to the publishing process.
>       There can be many contributors.

Note that this spec does not address contributors as that is an internal
matter for the publisher.

Eliot