Subject: [hrpc] [Errata Rejected] RFC8280 (5307)

From: RFC Errata System <[email-masked]>
Date: Mon, 20 Aug 2018 08:22:18 -0700 (PDT)

The following errata report has been rejected for RFC8280,
"Research into Human Rights Protocol Considerations".

--------------------------------------
You may review the report below and at:
http://www.rfc-editor.org/errata/eid5307

--------------------------------------
Status: Rejected
Type: Technical

Reported by: Florian Schmaus <[email-masked]>
Date Reported: 2018-03-26
Rejected by: Allison Mankin (IRTF Chair) (IRSG)

Section: 5.2.3.4.1.

Original Text
-------------
While the
protocol does not specify that the resource must be exposed by the
client's server to remote users, in practice this has become the
default behavior.

Corrected Text
--------------

Notes
-----
The sentence is incorrect. The resource is exposed to the remote user in standard 1:1 chats, since servers are required to stamp the 'from' value with the full JID as per RFC 6120 §  8.1.2.1 (stanza-attribute-from-stamp conformance requirement).
Note that the situation is different in groupchats: The resource is not required to be exposed, but when MUC is used, the presence in the channel also reveals the overall presence of the user. This is however, likely to change with future MUC replacement protocols.
I'd also like to point out that RFC 6120 § 13.10.2. and RFC 6121 § 11. discuss the security considerations and provide guidance in order to prevent those leaks
 --VERIFIER NOTES-- 
The RFC's editors concluded that accepting the erratum would not add value.  IRTF Chair agrees.   

--------------------------------------
RFC8280 (draft-irtf-hrpc-research-14)
--------------------------------------
Title               : Research into Human Rights Protocol Considerations
Publication Date    : October 2017
Author(s)           : N. ten Oever, C. Cath
Category            : INFORMATIONAL
Source              : Human Rights Protocol Considerations
Area                : N/A
Stream              : IRTF
Verifying Party     : IRSG