Subject: [weirds] I-D Action: draft-ietf-weirds-using-http-03.txt

From: [email-masked]
Date: Wed, 27 Mar 2013 07:07:08 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.
 This draft is a work item of the Web Extensible Internet Registration Data Service Working Group of the IETF.

	Title           : Using the Registration Data Access Protocol (RDAP) with HTTP
	Author(s)       : Andrew Lee Newton
                          Byron J. Ellacott
                          Ning Kong
	Filename        : draft-ietf-weirds-using-http-03.txt
	Pages           : 11
	Date            : 2013-03-27

Abstract:
   This document describes the usage of the Registration Data Access
   Protocol (RDAP) using HTTP.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-weirds-using-http

There's also a htmlized version available at:
http://tools.ietf.org/html/draft-ietf-weirds-using-http-03

A diff from the previous version is available at:
http://www.ietf.org/rfcdiff?url2=draft-ietf-weirds-using-http-03

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Jean-Philippe Dionne <[email-masked]>
Date: Wed, 27 Mar 2013 13:09:03 -0400

Hi,

It is required to have "Security Consideration" section.  Some security 
measures have already been included in this document (5.5. Rate Limits 
and 5.6. Cross-Origin Resource Sharing) while the rest is in
draft-hollenbeck-weirds-rdap-sec-00.  Here's some text suggestion:

"
This document does not pose strong security requirements to the RDAP 
protocol.  However, it does not restrict against the use of security 
mechanisms offerred by the HTTP protocol.

This document made recommendations for server implementations against 
denial-of-service (section 5.5) and interreroperability with existing 
security mechanism in HTTP clients (section 5.6).

Additional security considerations to the RDAP protocol are coverred in 
[draft-hollenbeck-weirds-rdap-sec-00].
"

Jean-Philippe

On 03/27/2013 10:07 AM, [email-masked] wrote:
> _______________________________________________
> weirds mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/weirds
>

---

From: Andy Newton <[email-masked]>
Date: Thu, 28 Mar 2013 18:38:22 +0000

>[draft-hollenbeck-weirds-rdap-sec-00].

Jean-Philippe,

Thanks for pointing out this oversight.

I agree with your text, though the last paragraph creates a future
reference. Would you be fine with the following:

"Additional security considerations to the RDAP protocol will be covered
in future RFCs specifying specific security mechanisms and schemes."

-andy

---

From: Jean-Philippe Dionne <[email-masked]>
Date: Thu, 28 Mar 2013 15:01:49 -0400

Hi,

I think that's fine. I was puzzled by this future reference too, we must 
not defer all considerations to a future document.

Regards
Jean-Philippe