Subject: [weirds] I-D Action: draft-ietf-weirds-using-http-04.txt

From: [email-masked]
Date: Tue, 16 Apr 2013 17:31:49 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.
 This draft is a work item of the Web Extensible Internet Registration Data Service Working Group of the IETF.

	Title           : HTTP usage in the Registration Data Access Protocol (RDAP)
	Author(s)       : Andrew Lee Newton
                          Byron J. Ellacott
                          Ning Kong
	Filename        : draft-ietf-weirds-using-http-04.txt
	Pages           : 12
	Date            : 2013-04-16

Abstract:
   This document is one of a collection that together describe the
   Registration Data Access Protocol (RDAP).  It describes how RDAP is
   transported using the Hypertext Transfer Protocol (HTTP).

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-weirds-using-http

There's also a htmlized version available at:
http://tools.ietf.org/html/draft-ietf-weirds-using-http-04

A diff from the previous version is available at:
http://www.ietf.org/rfcdiff?url2=draft-ietf-weirds-using-http-04

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Byron Ellacott <[email-masked]>
Date: Wed, 17 Apr 2013 00:37:22 +0000

Many thanks to everyone for the rich WGLC feedback.  Here's the change
list from the draft:

 *  Revised introduction and abstract.
 *  Added negative responses other than 404.
 *  Added security considerations.
 *  Added and corrected references: CORS, RFC3912, RFC3987, RFC5890.
 *  Expanded on first use several acronyms.
 *  Updated 2119 language.

  Byron

On 17/04/13 10:31 AM, "[email-masked]"
<[email-masked]> wrote:

>_______________________________________________
>weirds mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/weirds

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Tue, 16 Apr 2013 20:10:11 -0700

Nice work, everyone!

A few things remain in -04:

1) "Appendix Appendix B" in Section 4.2.

2) The "Intended usage" thing in Section 8.1 is still weird.

3) The SHOULD in Section 5 seems vague to me.  (a) What does it mean to
"understand" it, exactly?  (b) When would one deviate from the normative
statement and what impact might it have on interoperability?

These can be fixed during/after IETF LC, so just tuck them away for later;
no need to do a -05 first unless you feel like it.

-MSK, participatorially

On Tue, Apr 16, 2013 at 5:37 PM, Byron Ellacott <[email-masked]> wrote:

> >       Title           : HTTP usage in the Registration Data Access
> Protocol
> >(RDAP)

---

From: Olaf Kolkman <[email-masked]>
Date: Tue, 23 Apr 2013 16:28:01 +0200

On Apr 17, 2013, at 5:10 AM, Murray S. Kucherawy <[email-masked]> wrote:

> 3) The SHOULD in Section 5 seems vague to me.  (a) What does it mean to "understand" it, exactly?  (b) When would one deviate from the normative statement and what impact might it have on interoperability?
> 
> These can be fixed during/after IETF LC, so just tuck them away for later; no need to do a -05 first unless you feel like it.
> 
> -MSK, participatorially
> 

Folk,

I am doing the shepherd write-up and I need some input:

1. ID-NITS
there are some warnings in the idnits that I need to make sure I understand.
http://www.ietf.org/tools/idnits/idnits

There is no split in Normative and Informative References.  I believe it might be wise to introduce shuch split if we ever want to bump this beast to Internet Standard maturity (without the split all references are treated as normative and that actually makes RFC4627 a downref and make idnits throw an error.)

Without this split there are a few things in the write-up that I cannot answer in a satisfying way.

2. Media Type

http://tools.ietf.org/html/rfc4288#section-5.1 calls for community review by sending a mail to [email-masked]
Has that happened? (A quick search in the archive did not return a hit.) (Am I understanding the RFC4288 requirement correctly)

3. IANA consideration

The text reads:

   The following is a preliminary template for an RDAP extension
   registration:

That begs the question: how to make this the production template? Do you need coordination with IANA?

A first version of the writeup is attached. There are some places where I've put [Follow-up] as an indication that action is needed pending the above.

--Olaf

---

From: SM <[email-masked]>
Date: Wed, 24 Apr 2013 07:10:11 -0700

Hi Olaf,
At 07:28 23-04-2013, Olaf Kolkman wrote:
>2. Media Type
>
>http://tools.ietf.org/html/rfc4288#section-5.1 calls for community 
>review by sending a mail to [email-masked]
>Has that happened? (A quick search in the archive did not return a 
>hit.) (Am I understanding the RFC4288 requirement correctly)

See RFC 6838 for the registration procedure.

Regards,
-sm

---

From: Olaf Kolkman <[email-masked]>
Date: Thu, 25 Apr 2013 09:22:45 +0200

> See RFC 6838 for the registration procedure.

Yep.. that reads:
"Notice of a potential media type registration in the standards tre  SHOULD be sent to the [email-masked] mailing list for review."

So the question still stands albeit with a different maillists address: Has that happened? Can the editors confirm that they have _not_ done so, because then I will send a mail to the mailinglist, I do not think that will block forward progress because that review can take place while the IESG is processing the doc.

--Olaf

---

From: SM <[email-masked]>
Date: Thu, 25 Apr 2013 00:49:40 -0700

Hi Olaf,
At 00:22 25-04-2013, Olaf Kolkman wrote:
>So the question still stands albeit with a different maillists 
>address: Has that happened? Can the editors confirm that they have 
>_not_ done so, because then I will send

That has not happened.  BTW, the "Security considerations: n/a" might 
be a problem.

Regards,
-sm

---

From: Olaf Kolkman <[email-masked]>
Date: Thu, 25 Apr 2013 10:01:25 +0200

On Apr 25, 2013, at 9:49 AM, SM <[email-masked]> wrote:

> That has not happened.  BTW, the "Security considerations: n/a" might be a problem.
Are you looking at version 04?

I think this is a reasonable security consideration?

7.  Security Considerations

   This document does not pose strong security requirements to the RDAP
   protocol.  However, it does not restrict against the use of security
   mechanisms offered by the HTTP protocol.

   This document made recommendations for server implementations against
   denial-of-service (Section 5.5) and interoperability with existing
   security mechanism in HTTP clients (Section 5.6).

   Additional security considerations to the RDAP protocol will be
   covered in future RFCs documenting specific security mechanisms and
   schemes.

---

From: SM <[email-masked]>
Date: Thu, 25 Apr 2013 01:57:22 -0700

Hi Olaf,
>Are you looking at version 04?

Yes.

>I think this is a reasonable security consideration?

With all due respect, no.

Here is the request:

"This specification registers the "application/rdap+json" media type.

       Type name: application

       Subtype name: rdap+json

       Required parameters: n/a

       Encoding considerations: n/a

       Security considerations: n/a

       Interoperability considerations: n/a

       Published specification: [[ this document ]]

       Applications that use this media type: RDAP

       Additional information: n/a

       Person & email address to contact for further information: Andy
       Newton <[email-masked]>

       Intended usage: COMMON

       Restrictions on usage: none

       Author: Andy Newton

       Change controller: IETF

       Provisional Registration: Yes"

I suggest looking at each of the above fields and see whether the 
entries are according to the guidance from the relevant RFC.

BTW, the references should be split.

Regards,
-sm

---

From: Byron Ellacott <[email-masked]>
Date: Fri, 26 Apr 2013 00:24:29 +0000

Hi Olaf,

From: Olaf Kolkman <[email-masked]<mailto:[email-masked]>>
Date: Thursday, 25 April 2013 5:22 PM
To: SM <[email-masked]<mailto:[email-masked]>>, "[email-masked]<mailto:[email-masked]> Group" <[email-masked]<mailto:[email-masked]>>
Subject: Re: [weirds] I-D Action: draft-ietf-weirds-using-http-04.txt

"Notice of a potential media type registration in the standards tre SHOULD be sent to the [email-masked]<mailto:[email-masked]> mailing list for review."

I have not sent mail to IANA regarding the media type registration; I am speaking only for myself, and not the other two editors.

  Byron

---

From: Byron Ellacott <[email-masked]>
Date: Fri, 26 Apr 2013 01:15:55 +0000

Hi all,

On 24/04/13 12:28 AM, "Olaf Kolkman" <[email-masked]> wrote:

>> These can be fixed during/after IETF LC, so just tuck them away for
>>later; no need to do a -05 first unless you feel like it.
>> 
>> -MSK, participatorially
>> 
>
>
>Folk,
>
>There is no split in Normative and Informative References.  I believe it
>might be wise to introduce shuch split if we ever want to bump this beast
>to Internet Standard maturity (without the split all references are
>treated as normative and that actually makes RFC4627 a downref and make
>idnits throw an error.)
>

As a first pass at this split:

Normative:
	RFC 2119
	RFC 2616 [HTTP]
	RFC 3986 [URI]
	RFC 3987 [IRI]
	RFC 6585 [HTTP-response, 429]
	W3C.CR-cors-20130129 [Access-Control-Allow-Origin header]

Informative:
	SAC-051  [Origin of "RDAP" terminology]
	RFC 4627 [JSON media type; Informational]
	RFC 3912 [WHOIS specification]
	RFC 5234 [ABNF]
	RFC 5890 [IDNA-2008]

How does that look?

  Byron

---

From: Olaf Kolkman <[email-masked]>
Date: Mon, 29 Apr 2013 17:20:51 +0200

The message below was the last in this thread (it is just there for context, to demonstrate we are in limbo, and this is a top post).

The status is that we need to suppply the media-type template for review to the media-types list. 

SM raised some concern that the media type template is underspecified (he probably has a point) and he wanted to write some text. The template needs a few references to the document before it can be submitted. If SM doesn't get around it it is probably wiser for the document editors to take a stab and spin the document.

formalities formalities.

--Olaf

---

From: SM <[email-masked]>
Date: Mon, 29 Apr 2013 10:53:14 -0700

Hi Olaf,
At 08:20 29-04-2013, Olaf Kolkman wrote:
>SM raised some concern that the media type template is 
>underspecified (he probably has a point) and he wanted to write some 
>text. The template needs a few references to the document before it 
>can be submitted. If SM doesn't get around it it is probably wiser 
>for the document editors to take a stab and spin the document.

I did not forget.  I am busy with some working group work (you may 
have seen the thread).  If the document editors can take a stab at 
the text I'll review it.  I can also "send text" but it's unlikely 
that I may be able to do it within the next few days.

Regards,
-sm

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Mon, 29 Apr 2013 14:48:06 -0700

On Mon, Apr 29, 2013 at 8:20 AM, Olaf Kolkman <[email-masked]> wrote:

> The message below was the last in this thread (it is just there for
> context, to demonstrate we are in limbo, and this is a top post).
>
> SM raised some concern that the media type template is underspecified (he
> probably has a point) and he wanted to write some text. The template needs
> a few references to the document before it can be submitted. If SM doesn't
> get around it it is probably wiser for the document editors to take a stab
> and spin the document.
>
> formalities formalities.
>
> --Olaf
>
>
>
>
> 7 <http://tools.ietf.org/html/draft-ietf-weirds-using-http-04#section-7>.  Security Considerations
>
>    denial-of-service (Section 5.5 <http://tools.ietf.org/html/draft-ietf-weirds-using-http-04#section-5.5>) and interoperability with existing
>    security mechanism in HTTP clients (Section 5.6 <http://tools.ietf.org/html/draft-ietf-weirds-using-http-04#section-5.6>).
>
> Olaf's the shepherd for this one, so speaking only as myself here, I think
this is fine.  I also think it's safe to add the reference to the rdap-sec
document since it looks like these two are going to go to the IESG at
approximately the same time.  That puts a little more "meat" in this
section as it thus points to something more concrete.

To the question of media type registration, RFC6838 says early review by
emailing to IANA is "strongly encouraged".  I suggest the authors send the
registration request to [email-masked] now, give them the context and
ask for review of it so that the result can be included in Olaf's writeup.

-MSK, participatin'

---

From: Andy Newton <[email-masked]>
Date: Tue, 30 Apr 2013 14:23:42 +0000

Just taking a stab at thisŠ

>       Encoding considerations: n/a

"The media described by this media-type is JSON. JSON supports Unicode. At
a minimum, all servers offering this media must support be capable of
serving it using UTF-8 encoding."

>       Security considerations: n/a

I'm not convinced a reference to the rdap-sec draft is needed as this is
specifically about the media, which is just JSON. So I think this will
suffice:

"See the Security Considerations specified in Section 6 of RFC 4627."

>       Interoperability considerations: n/a

Here we may need a forward reference to draft-ietf-weirds-json-response.

>       Additional information: n/a

And here we may want to reference the WEIRDS working group.

>       Provisional Registration: Yes"

What do people think?

-andy

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Tue, 30 Apr 2013 10:59:18 -0700

I think you could send the template as you have it in the draft, and
request guidance on exactly this set of points in the same message.
Mention up front that this is document has ended WGLC but has not started
IETF LC yet, so that the reviewer knows where we are in the process.

-MSK