Subject: [mile] Alexey Melnikov's Discuss on draft-ietf-mile-rfc5070-bis-22: (with DISCUSS and COMMENT)

From: "Alexey Melnikov" <[email-masked]>
Date: Wed, 01 Jun 2016 00:33:39 -0700

Alexey Melnikov has entered the following ballot position for
draft-ietf-mile-rfc5070-bis-22: Discuss

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-mile-rfc5070-bis/

----------------------------------------------------------------------
DISCUSS:
----------------------------------------------------------------------

I will move to yes when the following issue is discussed.

Robert Sparks' SecDir review reminded me: I am concerned by the
requirement to automatically download updates from IANA. If many devices
or software programs implement IODEF and start doing schema validation,
this can cause DDoS attack on IANA infrastructure.

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

In 3.29.3.1: there is still a reference to RFC 822 (should be RFC 5322)

In 4.1: it would be good to point to the W3C XML document about rules for
escaping special characters. Otherwise readers might just think that all
cases are covered in this section.

---

From: "Roman D. Danyliw" <[email-masked]>
Date: Thu, 2 Jun 2016 05:15:10 +0000

Hi Alexey,

Thanks for the review.  Responses to the DISCUSS and COMMENTs are inline ...

> -----Original Message-----
> From: Alexey Melnikov [mailto:[email-masked]]
> Sent: Wednesday, June 1, 2016 3:34 AM
> To: The IESG <[email-masked]>
> Cc: [email-masked]; Roman D. Danyliw <[email-masked]>;
> [email-masked]; [email-masked]; [email-masked];
> [email-masked]; [email-masked]
> Subject: Alexey Melnikov's Discuss on draft-ietf-mile-rfc5070-bis-22: (with
> DISCUSS and COMMENT)
> 
> When responding, please keep the subject line intact and reply to all email
> addresses included in the To and CC lines. (Feel free to cut this introductory
> paragraph, however.)
> 
> 

A response to Robert's review can be found here:

https://mailarchive.ietf.org/arch/msg/mile/hSH9Ot6L_VTb9zYcJNZzO_c-7dc

Note: I posed a few questions back to the working group, so not everything is resolved.

Actually, per Stephen's COMMENT on EAI (https://mailarchive.ietf.org/arch/msg/mile/N52_1W9aXRw6gZSEqu0Y_vFuFh0), this likely needs to be RFC5336.  I'll make the change and also make it a real reference.  It's hard coded text now.

> escaping special characters. Otherwise readers might just think that all cases
> are covered in this section.

Makes sense.  I'd actually prefer to remove the specific examples and just cite reference.

Roman

---

From: Alexey Melnikov <[email-masked]>
Date: Thu, 02 Jun 2016 10:04:50 +0100

Hi Roman,

> > Subject: Alexey Melnikov's Discuss on draft-ietf-mile-rfc5070-bis-22: (with

 [snip]

> Note: I posed a few questions back to the working group, so not

Ok, I replied to that message.

> Actually, per Stephen's COMMENT on EAI
> (https://mailarchive.ietf.org/arch/msg/mile/N52_1W9aXRw6gZSEqu0Y_vFuFh0),
> this likely needs to be RFC5336. 

Yes. Maybe keep both references?

> I'll make the change and also make it a
> real reference.  It's hard coded text now.

Good idea.

> Makes sense.  I'd actually prefer to remove the specific examples and

Works for me.

---

From: "Roman D. Danyliw" <[email-masked]>
Date: Thu, 2 Jun 2016 12:21:34 +0000

Hi Alexey!

> Sent: Thursday, June 02, 2016 5:05 AM
> To: Roman D. Danyliw <[email-masked]>; The IESG <[email-masked]>
> Cc: [email-masked]; [email-masked];
> [email-masked]; [email-masked]; mile-
> [email-masked]
> Subject: Re: Alexey Melnikov's Discuss on draft-ietf-mile-rfc5070-bis-22:
> (with DISCUSS and COMMENT)

[snip]

> (https://mailarchive.ietf.org/arch/msg/mile/N52_1W9aXRw6gZSEqu0Y_vFuF
> h
> > 0),

Makes sense.  I'll add in both 5322 and 5336.

Roman

---

From: "Roman D. Danyliw" <[email-masked]>
Date: Mon, 20 Jun 2016 14:40:35 +0000

Hello Alexey,

> > > Cc: [email-masked]; Roman D. Danyliw
> > > <[email-masked]>; [email-masked]; [email-masked];
> > > [email-masked]; [email-masked]; [email-masked]
> > > Subject: Alexey Melnikov's Discuss on
> > > draft-ietf-mile-rfc5070-bis-22: (with DISCUSS and COMMENT)
> > >
> 
>  [snip]
> 
> > > requirement to automatically download updates from IANA. If many
> > > devices or software programs implement IODEF and start doing schema
> > > validation, this can cause DDoS attack on IANA infrastructure.
> >

Several changes were made in the text in -23 to address this concerns.  These are documented in SecDir review threads:

https://mailarchive.ietf.org/arch/msg/mile/cz8_ZoyVYZX88QUoqeEgZQFUrYE

https://mailarchive.ietf.org/arch/msg/mile/uPHPtq_PvUvxKTP4jKA5x6_y2Jg

> > > --------------------------------------------------------------------

[snip]

> > > In 4.1: it would be good to point to the W3C XML document about
> > > rules for escaping special characters. Otherwise readers might just
> > > think that all cases are covered in this section.
> >

The text in -23 was updated to read as follows:

4.1.  Encoding
[snip]
   Certain characters have special meaning in XML and MUST not appear in
   literal form.  Per Section 2.4 of [W3C.XML], these characters MUST be
   escaped with a numeric character or entity reference.

Thanks for the detailed review.

Roman

---

From: "Roman D. Danyliw" <[email-masked]>
Date: Mon, 20 Jun 2016 14:35:40 +0000

Hi Alexey!

> From: Roman D. Danyliw [mailto:[email-masked]]
> Sent: Thursday, June 02, 2016 8:22 AM
> To: Alexey Melnikov <[email-masked]>; The IESG <[email-masked]>
[snip]
> > > > --

The updated text in -23 reads as follows:

2.12.  Email String

   An email address is represented in the information model by the EMAIL
   data type.  The format of the EMAIL data type is documented in
   Section 3.4.1 of [RFC5322] and Section 3.3 of [RFC6531].

3.18.1.  Address Class
[snip]
      3.   e-mail.  Email address, per the EMAIL data type.

3.29.3.1.  BulkObservable Class
[snip]
      3.   e-mail.  Email address (per the Address@category attribute).

---

From: Kathleen Moriarty <[email-masked]>
Date: Wed, 22 Jun 2016 15:53:52 -0400

Hi Alexey,

Do the recent updates address your concerns?

Thanks,
Kathleen

-- 

Best regards,
Kathleen

---

From: Alexey Melnikov <[email-masked]>
Date: Fri, 24 Jun 2016 17:59:38 +0100

Hi Kathleen/Roman,

> Do the recent updates address your concerns?

The latest version is an improvement.

One final point I am uncomfortable with:

4.3.  Validation

   IODEF documents MUST be well-formed XML.  It is RECOMMENDED that
   recipients validate the document against the schema described in
   Section 8.  However, mere conformance to this schema is not
   sufficient for a semantically valid IODEF document.  The text of
   Section 3 describes further formatting and constraints; some that
   cannot be conveniently encoded in the schema.  These MUST also be
   considered by an IODEF implementation.  Furthermore, the enumerated
   values present in this document are a static list that will be
   incomplete over time as select attributes can be extended by a
   corresponding IANA registry per Section 10.2.  Therefore, IODEF
   implementations MUST periodically update their schema and MAY need to
   update their parsing algorithms to incorporate newly registered
   values.

How realistic is this to require all implementations to update their
schema? Is IODEFv2 intended to be used by IoT devices that might not
have much battery/CPU power to do this?
(I appreciate that this is different from my original DISCUSS point, but
this is related to a change that was caused by my DISCUSS. So I would
like to discuss this quickly.)

Best Regards,
Alexey

---

From: "Roman D. Danyliw" <[email-masked]>
Date: Fri, 24 Jun 2016 18:09:28 +0000

Hello Alexey!

> Sent: Friday, June 24, 2016 1:00 PM
> To: Kathleen Moriarty <[email-masked]>; Roman D.
> Danyliw <[email-masked]>
> Cc: [email-masked]; [email-masked]; The IESG
> <[email-masked]>; [email-masked]; [email-masked]; draft-ietf-mile-rfc5070-
> [email-masked]
> How realistic is this to require all implementations to update their schema? Is
> IODEFv2 intended to be used by IoT devices that might not have much
> battery/CPU power to do this?
> (I appreciate that this is different from my original DISCUSS point, but this is
> related to a change that was caused by my DISCUSS. So I would like to discuss
> this quickly.)

Makes sense.  What about updating the text to read: "IODEF implementation SHOULD periodically ... ".

Roman

---

From: "Roman D. Danyliw" <[email-masked]>
Date: Fri, 24 Jun 2016 21:06:05 +0000

Hello Alexey!

> Sent: Friday, June 24, 2016 2:09 PM
> To: Alexey Melnikov <[email-masked]>; Kathleen Moriarty
> <[email-masked]>
> 
> > <[email-masked]>; [email-masked]; [email-masked];
> > draft-ietf-mile-rfc5070- [email-masked]
> > schema? Is
> > (I appreciate that this is different from my original DISCUSS point,
> > but this is related to a change that was caused by my DISCUSS. So I
> > would like to discuss this quickly.)
> 

The s/MUST/SHOULD/ was made in -25.

Roman

---

From: Alexey Melnikov <[email-masked]>
Date: Fri, 24 Jun 2016 23:48:42 +0100

Hi Roman,

> On 24 Jun 2016, at 22:06, Roman D. Danyliw <[email-masked]> wrote:
> 
> Hello Alexey!
> 

I think this is a reasonable compromise. Thank you!