Subject: [CDNi] Stephen Farrell's No Objection on draft-ietf-cdni-logging-22: (with COMMENT)

From: "Stephen Farrell" <[email-masked]>
Date: Wed, 02 Mar 2016 06:18:46 -0800

Stephen Farrell has entered the following ballot position for
draft-ietf-cdni-logging-22: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-cdni-logging/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Thanks for the additional text in -22, which clears
up the last of my discuss points.

old comments below, I didn't check 'em

- in the description of c-groupid, "the address 
with a shared secret that is pre-synchronised
and rotated at a predefined time interval" isn't
very clear. I know what you mean but I don't 
think you state it very clearly. Could be that a
bit of text earlier in the document that describes
the basic idea would be better than doing it all
inline as you have in -21.

OLD COMMENTS Below, not updated for -21, I didn't
check if you took 'em on board, feel free to chat about
'em if that's useful  - I'm happy to do so anyway.

- I support Richard's discuss. Isn't it ironic that the dCDN's
privacy (that of a company) is better supported than that of
the end user (a person) 

- 2.2.1 - why is per-chunk always needed? 

- 2.2.5.3: what's "track audience" mean?

- 2.2.5.4: there are more security goals in the universe

- 2.2.5.4: seems like the user is the enemy, that's odd

- 2.2.5.6.2: there is no "browser type header" that I know of,
but there is the well-known UA string. Being specific about
that is better.

- 3.1: SS.S - does that imply a time granularity of 100ms?  If
so, please say so.

- 3.4.4: cs-uri: please not that these can be privacy
sensitive, though presumably less so than e.g.  logged URIs on
a search engine.

- 3.4.4: foo-uri: do these contain fragments or not?