Subject: [weirds] Kathleen Moriarty's No Objection on draft-ietf-weirds-rdap-sec-11: (with COMMENT)

From: "Kathleen Moriarty" <[email-masked]>
Date: Tue, 25 Nov 2014 12:05:21 -0800

Kathleen Moriarty has entered the following ballot position for
draft-ietf-weirds-rdap-sec-11: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to http://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
http://datatracker.ietf.org/doc/draft-ietf-weirds-rdap-sec/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Thanks for your work on this and the other Weirds drafts and adding in my
requested text on privacy options to the response draft (Alissa's in this
draft) as well as addressing my other discuss points (TLS BCP, etc.). 
The new sections are helpful to explain privacy and access control
options (3.1) that have been added in this new protocol.

Section 3.1
As an FYI (not asking for anything to be done here except to participate
in HTTPAuth last calls) - HTTP Digest and Basic just went through a
revision and are just about done.  There are a few minor updates and the
security considerations in the updated documents spell out the remaining
issues.  Although these are the solutions for HTTP Auth, most people
don't rely on it and use other methods, so we don't have implementations
of better options.  There are a few other options in the HTTPAuth WG
about to go to IETF last call or are WG drafts.  If you are going to rely
on HTTPAuth methods, maybe there should be a push for the improved
options from the WEIRDS WG - at least pitching in to review during last
calls.  
https://datatracker.ietf.org/wg/httpauth/documents/