Subject: Re: Last Call: <draft-leiba-3967upd-downref-00.txt> (Updating when Standards Track Documents may Refer Normatively to Documents at a Lower Level) to Best Current Practice

From: Brian E Carpenter <[email-masked]>
Date: Wed, 19 Oct 2016 08:31:18 +1300

Hi,

I broadly in favour of this change, but I have a few comments.
First, a minor suggestion on the text itself:

OLD:
   The responsible AD should
   still check for downrefs before sending out the last call notice, but
   any need to repeat a last call if this has not been done is at the
   discretion of the IESG.
NEW:
   The responsible AD should
   still check for downrefs before sending out the last call notice, but
   if an undetected downref is noticed during last call or IESG review,
   any need to repeat the last call is at the discretion of the IESG.

Second,

>    there are no related security
>    considerations.

That bothers me a tiny bit. A missed downref could have security implications.

Third, I believe that in addition to this procedural change, there is a
little work needed on the ecosystem:

1. Make the downref registry an intrinsic part of the data tracker. I mean that
each document listed at https://trac.tools.ietf.org/group/iesg/trac/wiki/DownrefRegistry
would instead be tagged as 'downref allowed' in the tracker, with appropriate GUI
support for the IESG to apply this tag.

2. Enhance idnits slightly to check this tag when it detects a downref.
A downref to a 'downref allowed' document would be a warning, and a downref
to a non-downref-allowed document would be an error.

Regards
   Brian Carpenter

On 19/10/2016 04:11, The IESG wrote:
> 
> The IESG has received a request from an individual submitter to consider
> the following document:
> - 'Updating when Standards Track Documents may Refer Normatively to
>    Documents at a Lower Level'
>   <draft-leiba-3967upd-downref-00.txt> as Best Current Practice
> 
> The IESG plans to make a decision in the next few weeks, and solicits
> final comments on this action. Please send substantive comments to the
> [email-masked] mailing lists by 2016-11-15. Exceptionally, comments may be
> sent to [email-masked] instead. In either case, please retain the
> beginning of the Subject line to allow automated sorting.
> 
> Abstract
> 
> 
>    RFC 3967 specifies a process for allowing normative references to
>    documents at lower maturity levels ("downrefs"), which involves
>    calling out the downref explicitly in the last call notice.  That
>    requirement has proven to be unnecessarily strict, and this document
>    updates RFC 3967, allowing the IESG more flexibility in accepting
>    downrefs in Standards Track documents.
> 
> 
> 
> 
> The file can be obtained via
> https://datatracker.ietf.org/doc/draft-leiba-3967upd-downref/
> 
> IESG discussion can be tracked via
> https://datatracker.ietf.org/doc/draft-leiba-3967upd-downref/ballot/
> 
> 
> No IPR declarations have been submitted directly on this I-D.
> 
> 
> 
> 
>

---

From: Barry Leiba <[email-masked]>
Date: Tue, 18 Oct 2016 15:55:13 -0400

> I broadly in favour of this change, but I have a few comments.

Thanks, Brian.

>    any need to repeat the last call is at the discretion of the IESG.

Yes, that reflects the intent and is more explicitly clear.  I like the change.

> That bothers me a tiny bit. A missed downref could have security implications.

I agree, but I contend that this doesn't make it any more likely that
we'll miss a downref.  In fact, this change is only operable when we
*don't* miss it -- it simply gives the IESG judgment on whether last
call needs to be repeated when we catch it.  And the Security ADs will
certainly have a say in that, if they think that broader review of the
downref is warranted for security checking.

> to a non-downref-allowed document would be an error.

I agree that those would be excellent changes, and I'll ask Ben, as
sponsoring AD, to send that request up to the tools team.  I don't
gather than you're asking that the document be held for that, correct?

The change you suggest above is in my working copy for the next draft revision.

Barry

---

From: Brian E Carpenter <[email-masked]>
Date: Wed, 19 Oct 2016 09:58:24 +1300

Hi Barry,

Clarifications in line...

> downref is warranted for security checking.

True. How about s/related/directly related/ ? But I certainly don't insist.

> gather than you're asking that the document be held for that, correct?

Correct; it's orthogonal.

> The change you suggest above is in my working copy for the next draft revision.

Thanks!

   Brian

---

From: Barry Leiba <[email-masked]>
Date: Tue, 18 Oct 2016 17:01:32 -0400

> True. How about s/related/directly related/ ? But I certainly don't insist.

Well, as I think about it, I might just put in a note that references
to immature protocols can have security implications, and that should
be considered in deciding whether re-consulting the community is
useful.

b