Subject: [weirds] review comments on draft-ietf-weirds-rdap-sec

From: Marc Blanchet <[email-masked]>
Date: Fri, 22 Feb 2013 15:42:46 -0500

hello,
please find my comments embedded in the copy of the draft and tagged with <MB>. credit: Few of the comments are also from my colleague Jean-Philippe Dionne.

Regards, Marc.

---

From: Ning Kong <[email-masked]>
Date: Fri, 1 Mar 2013 11:43:27 +0800

Hi Marc and Jean-Philippe,

Thanks for your review. Below are my feedbacks.

3.1.  Authentication
> <MB>There is an IETF thread going on to update/obsolete these basic schemes (see httpauth working group charter).  Therefore, it should be prudent to instead align with that.
> </MB>

I agree that we should follow the relative outputs of this proposed WG.

> <MB>but federated authentication is optional. So small change to clarify:
> 
> NEW:
>    REQUIREMENT: Federated authentication mechanisms used by RDAP are optional. However, if used, they MUST be fully supported by HTTP.
> </MB>
Good suggestion. Thanks.

> <MB>One thing related to availability, especially from the client point of view, is query throttling, commonly used. I think it should be mentionned here. Moreover, it could be appropriate to define a standard way to signal the client about that fact, so all clients may respond correctly, instead of throwing the error message to the user.
> 
> Suggested text:
> An RDAP service may use a throttling mechanism to limit the number of queries a single client may be sending in a given period of time. In this case, the server should send a 503 Service Unavailable message:
> 
> http://tools.ietf.org/html/rfc2616#section-10.5.4
> 
> The Retry-After response-header field can be used to give an hint to the client
> http://tools.ietf.org/html/rfc2616#section-14.37
> 
> </MB>

The throttling mechanism is related with the rate limiting which was discussed by the mailing list. IMO, the approach of rate limiting is worth to be covered by this draft. I think Scott may give more feedbacks on this point.

Thanks again.

Cheers,
Ning

---

From: SM <[email-masked]>
Date: Thu, 28 Feb 2013 22:18:30 -0800

Hi Ning,

I took a quick look at draft-ietf-weirds-rdap-sec-01.  Is it a 
protocol specification or a requirements document?

What is the meaning of "security services"?

Regards,
-sm