Subject: [Gen-art] RE: Gen-ART Last Call Review of draft-edwards-urn-smpte-01.txt

From: "Thomas Edwards" <[email-masked]>
Date: Sun, 3 Jun 2007 15:57:10 -0400

Eric,

Thank you very much for your review of draft-edwards-urn-smpte-01!

You mentioned concern about the reference for the statement: "There are
no additional security considerations other than those normally
associated with the use and resolution of URNs in general."

This statement is present in the Security Considerations sections of the
following URN registrations RFCs:

RFC 3043, RFC 3121, RFC 3151, RFC 3541, RFC 3614, RFC 3937, RFC 4179,
RFC 4198, RFC 4688, RFC 4854

Unfortunately, none of these RFCs have references to the particular
security considerations "normally associated with the use and resolution
of URNs in general."

While I could pull this language from this I-D, I am concerned about
removing security language which appears to have been accepted by the
IETF in 10 RFCs.  I would like to seek Gen-ART's opinion on this issue.

With regard to the comment about "Participation in these Committees is
open to all with a bona fide interest in their work," this text is
sourced from a SMPTE document, thus I would prefer to keep it as it
stands, but if Gen-ART can document the grammatical concern on this
issue I could bring it up with SMPTE staff. 

Thomas Edwards
[email-masked]
Senior Manager, Interconnection Engineering
PBS
6453 Stephenson Way
Alexandria, VA 22312
(703) 739-5270
 
-----Original Message-----
From: Eric Gray (LO/EUS) [mailto:[email-masked]] 
Sent: Tuesday, May 29, 2007 12:18 PM
To: Thomas Edwards
Cc: [email-masked]; Chris Newman
Subject: Gen-ART Last Call Review of draft-edwards-urn-smpte-01.txt

Thomas,

I have been selected as the General Area Review Team (Gen-ART)
reviewer for this draft (for background on Gen-ART, please see
http://www.alvestrand.no/ietf/gen/art/gen-art-FAQ.html).

Please resolve these comments along with any other Last Call comments
you may receive.

Document: SMPTE URN Definition (draft-edwards-urn-smpte-01.txt)

Reviewer: Eric Gray
Review Date:  05/29/2007
IETF LC End Date:  05/29/2007

Summary:
This document is not ready for publication as an Informational RFC.

Comments:

In the security considerations section, the author indicates that
there are known security issues with "use and resolution of URNs 
in general" but does not provide a reference to where these issues
are addressed (or at least identified).

If such a reference exists, this section should cite that reference
and the author should add that reference to the list of (informative) 
references.  If no such reference exists, I am not sure what value
including this statement offers.

NITs:

In the first paragraph of the Introduction, third sentence, 8th
line: I recommend replacing "their" with "a committee's"...

--
Eric Gray
Principal Engineer
Ericsson 

_________________________________________________________________

FETCH! WITH RUFF RUFFMAN
Fun all week long! Starting May 21st 
New contestants! New challenges! More fun!
Check out a new season on weekdays, starting Memorial Day on PBS KIDS GO!
pbskids.org

_________________________________________________________________
_________________________________________________________________

This email may contain material that is confidential or proprietary to PBS and is intended solely for use by the intended recipient.  Any review, reliance or distribution of such material by others, or forwarding of such material without express permission, is strictly prohibited.  If you are not the intended recipient, please notify the sender and destroy all copies.
__________________________________________________________________

_______________________________________________
Gen-art mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/gen-art

---

From: "Eric Gray (LO/EUS)" <[email-masked]>
Date: Mon, 4 Jun 2007 10:03:39 -0500

Thomas,

	The grammatical concern is that "their work" is ambiguous and
- by its location in the sentence - actually refers to work belonging
to "all" rather than "these Committees".

	It's a very minor point, but the way the sentence is structured
I was struck by the notion that maybe I should join given that I have
a bona fide interest in my work.  :-)

	As for the reference to "those (security concerns) normally 
associated with ...", the fact that you can show any number of other
places where the same content-free text appears, does not change the
fact that the text is still content free.

	For the record, I do NOT prefer that the text should be removed,
but would like to see some content added in its place.  Clearly, there
has been reason on numerous occasions in the past to believe either a
(reasonably) well known set of security concerns does exist, or that 
it is not known whether or not such security concerns exist and each
(set of) author(s) in these other RFCs has elected to "punt" on the 
issue.

	If there are any known security issues, then they should be 
documented somewhere (probably NOT in this document).  If there has
ever been any sort of analysis that shows that there are no security
issues, then that also should have been documented somewhere.  And,
if there is a reasonable basis for arguing that this type of document
or activity is unlikely to introduce ANY sort of security issue, than
at least that statement should be made here.

	Anything else is simply punting on security issues.

	Again, for the record, it was for very similar reasons that the
majority of RFCs used to say:

	"Security issues are not discussed in this memo."

I can provide large numbers of references to RFCs that say this, yet
I believe there is a fairly common agreement at this point that this
is not okay any more.

	All of that said, however, if there is not a general agreement
among the others that review these documents for Gen-ART, and the AD
(Chris Newman) is okay with what the current wording, then let it stay
as is...

Thanks!

--
Eric Gray
Principal Engineer
Ericsson  

> From: Thomas Edwards [mailto:[email-masked]] 
> Sent: Sunday, June 03, 2007 3:57 PM
> To: Eric Gray (LO/EUS)
> Subject: RE: Gen-ART Last Call Review of 
> draft-edwards-urn-smpte-01.txt
> Importance: High
> 
> Eric,
> 
> This email may contain material that is confidential or 
> proprietary to PBS and is intended solely for use by the 
> intended recipient.  Any review, reliance or distribution of 
> such material by others, or forwarding of such material 
> without express permission, is strictly prohibited.  If you 
> are not the intended recipient, please notify the sender and 
> destroy all copies.

---

From: "Eric Gray (LO/EUS)" <[email-masked]>
Date: Fri, 8 Jun 2007 09:35:06 -0500

Chris,

	Thomas has proposed making the following changes and I feel
that these changes more than adequately address the concerns raised
in my Gen-ART review.

Thanks!

--
Eric Gray
Principal Engineer
Ericsson  

>> Regarding draft-edwards-urn-smpte-01, you were concerned about two
>> issues:
>> 
>> 1) Security issues:  You were concerned about references to security
>> considerations for URNs in general.  I believe that the best language
is
>> that of draft-goodwin-iso-urn-01 which states:
>> 
>> "The ISO URN Namespace ID shares the security considerations outlined
in
>> [RFC3406], but has no other known security considerations."
>> 
>> 2) Grammatical nit:  In the first paragraph of the Introduction,
third
>> sentence, 8th line, you suggested replacing "their" with "a
>> committee's".  I will make this change in the I-D, and I have also
>> brought this issue to the SMPTE Engineering Director for Television,
and
>> he agrees with your view that the language is unclear, and this
language
>> may change in future SMPTE documents.
>>