Subject: [clue] CLUE framework, security consideration section, level of mandation

From: Stephan Wenger <[email-masked]>
Date: Mon, 29 Dec 2014 02:51:46 +0000

Hi,

Mark and I are editing the framework document to address comments.
This is with reference to my review, dated 12/16/2014, and specifically point 9 therein, reproduced as follows:

9. Page 70, first paragraphs.  There are two unqualified "SHOULD" statements.  In the spirit of fast doc approval, I wouldn't object if those were changed to "MUST".  I don't recall that we discussed these points before, but I could easily have missed that discussion.

Unless someone objects the two SHOULD statements will be replaced with MUST.  The modified paragraph in markup is shown below (also addressing comment 8 of my review, but that's an editorial change and should be uncontroversial).  Sorry for the messy formatting.

I suggest a deadline of January 9, 2015, but do so without checking with the chairs-who are of course free to set a different date if they choose so.

Regards,
Stephan

   A separate data channel is established to transport the CLUE
   protocol messages. The contents of the CLUE protocol messages are
   based on information introduced in this document, which is
   represented by an XML schema for this information defined in the
   CLUE data model [ref].  The CLUE data model [I-D.ietf-clue-data-model-schema] defines through an XML schema the syntax to be used.  Some of the information which could possibly introduce privacy concerns is the xCard information as described in section 7.1.1.11.  In addition, the (text)

   description field in the Media Capture attribute (section 7.1.1.7)
   could possibly reveal sensitive information or specific
   identities. The same would be true for the descriptions in the
   Capture Scene (section 7.3.1) and Capture Scene View (7.3.2)
   attributes.   One other important consideration for the
   information in the xCard as well as the description field in the
   Media Capture and Capture Scene View attributes is that while the
   endpoints involved in the session have been authenticated, there
   is no assurance that the information in the xCard or description
   fields is authentic.  Thus, this information SHOULD MUST not be used to
   make any authorization decisions and the participants in the
   sessions SHOULD MUST be made aware of this.

---

From: "Roni Even" <[email-masked]>
Date: Mon, 29 Dec 2014 13:03:46 +0200

Hi,

OK with this change

Roni Even

As individual

From: clue [mailto:[email-masked]] On Behalf Of Stephan Wenger
Sent: 29 December, 2014 4:52 AM
To: CLUE
Subject: [clue] CLUE framework, security consideration section, level of
mandation

Hi,

This is with reference to my review, dated 12/16/2014, and specifically
point 9 therein, reproduced as follows:

9. Page 70, first paragraphs.  There are two unqualified "SHOULD"
statements.  In the spirit of fast doc approval, I wouldn't object if those
were changed to "MUST".  I don't recall that we discussed these points
before, but I could easily have missed that discussion.

Unless someone objects the two SHOULD statements will be replaced with MUST.
The modified paragraph in markup is shown below (also addressing comment 8
of my review, but that's an editorial change and should be uncontroversial).
Sorry for the messy formatting.

I suggest a deadline of January 9, 2015, but do so without checking with the
chairs-who are of course free to set a different date if they choose so.

Regards,

Stephan

   CLUE data model [ref].  The CLUE data model
[I-D.ietf-clue-data-model-schema] defines through an XML schema the syntax
to be used.  Some of the information which could possibly introduce privacy
concerns is the xCard information as described in section 7.1.1.11.  In
addition, the (text)