Subject: [regext] WG LAST CALL: draft-ietf-regext-epp-rdap-status-mapping

From: "James Galvin" <[email-masked]>
Date: Fri, 17 Jun 2016 09:27:18 -0400

The following document was adopted with Charter at the beginning of this 
year:

https://datatracker.ietf.org/doc/draft-ietf-regext-epp-rdap-status-mapping/

The chairs would like to ask the working group if this document is ready 
for publication?  Please respond to this by Friday, 24 June 2016.

It was primarily discussed when it was an individual draft on the IETF 
WEIRDS working group mailing list.  Here is a link to that document just 
for completeness:

https://datatracker.ietf.org/doc/draft-gould-epp-rdap-status-mapping/

One question for the working group to consider as part of last call is 
to confirm the intended status of this document.  The document currently 
says that is informational.

However, it does register new RDAP statuses, which would suggest that it 
should be standards track.

Please reply to this message and indicate if you believe this document 
is ready for publication and what status you believe the document should 
have: informational or standards track?

Thanks,

Antoin and Jim

---

From: "Hollenbeck, Scott" <[email-masked]>
Date: Fri, 17 Jun 2016 13:50:37 +0000

Two comments:

1. The IANA Considerations section includes requests to register a number of RDAP status values. The registrant for each of these values is "VeriSign Inc.". Given that the intended status of this document is currently "Informational" that might be OK, but since these values aren't proprietary to Verisign I'm going to suggest that it might be more appropriate for the IESG to be the registrant.

OLD:
Registrant Name: VeriSign Inc.
Registrant Contact Information: [email-masked]

NEW:
Registrant Name: IESG
Registrant Contact Information: [email-masked]

2. The Security Considerations section says "The mapping described in this document do not provide any security services beyond those described by RDAP [RFC7483]". That's true, but I think some text needs to be added to note that implementation of this mapping can expose more information about registered domain names to any client who asks, and that raises privacy concerns. The issue should be noted, and the possible mitigation using client authentication with authorization and access control policies can be described.

Scott

---

From: Gustavo Lozano <[email-masked]>
Date: Tue, 21 Jun 2016 17:27:59 +0000

I agree with Scott¹s comments.

I agree with Jim Galvin¹s suggestion that this draft should be standards
track.

After these changes, I think that the draft should be ready for
publication as an RFC.

It's worth mentioning that this draft is important for the RDAP deployment
efforts in the gTLD space.

Regards,
Gustavo

On 6/17/16, 06:50, "regext on behalf of Hollenbeck, Scott"
<[email-masked] on behalf of [email-masked]> wrote:

>Two comments:
>
>1. The IANA Considerations section includes requests to register a number
>of RDAP status values. The registrant for each of these values is
>"VeriSign Inc.". Given that the intended status of this document is
>currently "Informational" that might be OK, but since these values aren't
>proprietary to Verisign I'm going to suggest that it might be more
>appropriate for the IESG to be the registrant.
>
>OLD:
>2. The Security Considerations section says "The mapping described in
>this document do not provide any security services beyond those described
>by RDAP [RFC7483]". That's true, but I think some text needs to be added
>to note that implementation of this mapping can expose more information
>about registered domain names to any client who asks, and that raises
>privacy concerns. The issue should be noted, and the possible mitigation
>using client authentication with authorization and access control
>policies can be described.
>
>Scott
>
>_______________________________________________
>regext mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/regext