Subject: [http-auth] Mirja Kühlewind's No Objection on draft-ietf-httpauth-extension-08: (with COMMENT)

From: "Mirja Kuehlewind" <[email-masked]>
Date: Thu, 01 Sep 2016 05:40:32 -0700

Mirja Kühlewind has entered the following ballot position for
draft-ietf-httpauth-extension-08: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-httpauth-extension/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

1) The following disclarer is a little odd:

"The terms "encouraged" and "advised" are used for suggestions that do
   not constitute "SHOULD"-level requirements.  People MAY freely choose
   not to include the suggested items.  However, complying with those
   suggestions would be a best practice; it will improve the security,
   interoperability, and/or operational performance."

Both terms are only used once. I would recommend to remove the text above
and simply use MAY later in the doc (or not use MAY and leave the later
text as it is just without the disclaimer).

2) I agree that the section on username should point to the secturity
section to give a clear warning. However, I also don't really understand
why username is needed. If there is a good use case for it, maybe it's
worth to explain this as another example.

---

From: 大岩寛 <[email-masked]>
Date: Sat, 3 Sep 2016 03:31:26 +0000

Dar Mirja,

thank you for your comments.

> Both terms are only used once. I would recommend to remove the text above and
> simply use MAY later in the doc (or not use MAY and leave the later text as
> it is just without the disclaimer).
>
We'll update it.  After we divided a single draft into three parts,
I agree that this clause became too much for this draft.

> 2) I agree that the section on username should point to the secturity section
> to give a clear warning. However, I also don't really understand why username
> is needed. If there is a good use case for it, maybe it's worth to explain this
> as another example.

We'll add a simple example for this.  Thank you very much.

-- 
Yutaka OIWA, Ph.D.       Leader, Cyber Physical Architecture Research Group
                                  Information Technology Research Institute
    National Institute of Advanced Industrial Science and Technology (AIST)
                      Mail addresses: <[email-masked]>, <[email-masked]>
OpenPGP: id[440546B5] fp[7C9F 723A 7559 3246 229D  3139 8677 9BD2 4405 46B5]