[weirds] Ted Lemon's Discuss on draft-ietf-weirds-rdap-sec-10: (with DISCUSS)

["Ted Lemon" <[e-mail]>]

Ted Lemon has entered the following ballot position for
draft-ietf-weirds-rdap-sec-10: Discuss

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)


Please refer to http://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.


The document, along with other ballot positions, can be found here:
http://datatracker.ietf.org/doc/draft-ietf-weirds-rdap-sec/



----------------------------------------------------------------------
DISCUSS:
----------------------------------------------------------------------

As far as I can tell, this specification effectively relies on HTTP
authentication as its sole MTI mechanism, and leaves things like OAuth as
sort of "you could do this, but we aren't saying how."   I am deeply
uncomfortable with this, because HTTP authentication really sucks when
you are trying to make it work in a context where authentication is
optional.

I think if you want to rely on this mechanism, you need to give the
reader more guidance on how to make this work.   What I mean is that in
order to trigger the client to send authentication, you have to send back
a 401 Unauthorized HTTP response.   But that assumes that authentication
_is_ required, and it's not.   So how does the server know to send back
the HTTP unauthorized response?   The answer is that it does not, and so
you need to somehow signal to the client that it should send more
authentication info if it wants better information, while still returning
information in case the client has no credentials to offer.

This is probably doable, but simply relying on RFC 7235 without
explaining how to make it work isn't sufficient.