Subject: RE: Gen-ART review of draft-bundesbank-eurosystem-namespace-02

From: "Black, David" <[email-masked]>
Date: Tue, 17 Dec 2013 10:06:21 -0500

Miriam,

> We have been surprised by your concerns regarding the application for a
> Formal URN Namespace, which we'd have expected being raised by someone
> during the two stages of URN-NID Expert Review the draft has undergone
> since August 2013.  Apparently, the URN experts
> active on the urn-nid list did not share your concerns.

IETF operates a multi-round review process that encourages reviews of
drafts by people beyond the experts in the specific technology.

This review is an expected part of that process; I suggest that you
consult with your sponsoring AD (Barry) on any process concerns.

> The (prospective) 'eurosystem' URN Namespace is modeled after the very
> similar 'swift' Formal URN namespace registered per RFC 3615, and there
> have been allocated quite a couple of other Formal URN Namespaces to
> national institutions and international treaty organizations, which seem to
> have similar usage profiles; we are not aware of similar arguments having
> been raised against the allocation of these Formal URN Namespaces.

For clarity, I am not opposed to the allocation of the namespace.  However,
I would like to see a Community Considerations section that is actually
responsive to RFC 3406's stated requirement.

[... snip ...]

> We will confer with the sponsoring AD on possible amendments to the
> Community Considerations in our draft. (Based on previous feedback, this
> section has been kept relatively short and concise.)

Much of the contents of your response would be useful explanatory
text to add to the draft.

Thanks,
--David

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]
> On Behalf Of [email-masked]
> Sent: Tuesday, December 17, 2013 9:39 AM
> To: Black, David
> Cc: [email-masked]; [email-masked]; [email-masked]; [email-masked]
> Subject: Re: Gen-ART review of draft-bundesbank-eurosystem-namespace-02
> 
> 
> David,
> 
> thanks for the Gen-ART review [1] you have performed on our draft, and our
> apologies for the delay in responding to it.
> 
> We have been surprised by your concerns regarding the application for a
> Formal URN Namespace, which we'd have expected being raised by someone
> during the two stages of URN-NID Expert Review the draft has undergone
> since August 2013.  Apparently, the URN experts
> active on the urn-nid list did not share your concerns.
> 
> The (prospective) 'eurosystem' URN Namespace is modeled after the very
> similar 'swift' Formal URN namespace registered per RFC 3615, and there
> have been allocated quite a couple of other Formal URN Namespaces to
> national institutions and international treaty organizations, which seem to
> have similar usage profiles; we are not aware of similar arguments having
> been raised against the allocation of these Formal URN Namespaces.
> 
> 'eurosystem' URNs will be used together with already standardized URNs, in
> particular ISO Std 20022 URNs; it is important for their use that the role
> of these URNs and the authority behind these URNs be easily and clearly
> identified, and be at a perceived "equivalent" standards level -- parallel
> to the 'swift' URNs that are managed by an older international treaty
> organization with similar purpose but smaller scope and less consumer
> friendly targets (regarding timeliness of transaction execution and cost
> effectiveness). Therefore, an Informal URN Namespace would not meet the
> target objectives of the supporting countries and financial institutions.
> 
> Admittedly, it is true that, at the first stage of usage of the
> 'eurosystem' namespace, the mass production use of the assigned URNs will
> be contained in messages carried in cryptographic digital envelopes or
> Vitual Private Networks.  However, the transparency requirements (needed
> for establishing and maintaining public trust into the subject financial
> transaction systems), open software development processes, and software
> deployment require the origin and authority for the URNs to be easily
> identified, and the URNs to be resolved on the public Internet.
> Therefore we claim that a Formal URN Namespace is warranted for the
> intended purpose.
> 
> We will confer with the sponsoring AD on possible amendments to the
> Community Considerations in our draft. (Based on previous feedback, this
> section has been kept relatively short and concise.)
> 
> Kind regards,
> Miriam
> 
> 
> [1]
>   http://www.IETF.ORG/mail-archive/web/ietf/current/msg84600.html
> 
> --
> Diese E-Mail enthält vertrauliche und/oder rechtlich geschützte
> Informationen. Wenn Sie nicht der richtige Adressat sind oder diese E-Mail
> irrtümlich erhalten haben, informieren Sie bitte sofort den Absender und
> vernichten Sie diese E-Mail. Das unerlaubte Kopieren sowie die unbefugte
> Weitergabe dieser Mail oder von Teilen dieser Mail ist nicht gestattet.
> 
> Wir haben alle verkehrsüblichen Maßnahmen unternommen, um das Risiko der
> Verbreitung virenbefallener Software oder E-Mails zu minimieren, dennoch
> raten wir Ihnen, Ihre eigenen Virenkontrollen auf alle Anhänge an dieser
> Nachricht durchzuführen. Wir schließen außer für den Fall von Vorsatz oder
> grober Fahrlässigkeit die Haftung für jeglichen Verlust oder Schäden durch
> virenbefallene Software oder E-Mails aus.
> 
> Jede von der Bank versendete E-Mail ist sorgfältig erstellt worden, dennoch
> schließen wir die rechtliche Verbindlichkeit aus; sie kann nicht zu einer
> irgendwie gearteten Verpflichtung zu Lasten der Bank ausgelegt werden.
> ______________________________________________________________________
> 
> This e-mail may contain confidential and/or privileged information. If you
> are not the intended recipient (or have received this e-mail in error)
> please notify the sender immediately and destroy this e-mail. Any
> unauthorised copying, disclosure or distribution of  the material in this
> e-mail or of parts hereof is strictly forbidden.
> 
> We have taken precautions to minimize the risk of transmitting software
> viruses but nevertheless advise you to carry out your own virus checks on
> any attachment of this message. We accept no liability for loss or damage
> caused by software viruses except in case of gross negligence or willful
> behaviour.
> 
> Any e-mail messages from the Bank are sent in good faith, but shall not be
> binding or construed as constituting any kind of obligation on the part of
> the Bank.
>

---

From: Jari Arkko <[email-masked]>
Date: Tue, 17 Dec 2013 11:56:07 -0500

David: thank you for your review. I thought that

> Therefore we claim that a Formal URN Namespace is warranted for the

would be good material to add to the draft, it made the situation clear at least for me. And I did think the community section was a bit short.

Barry/Miriam, can you coordinate some suggested text before the IESG approval telechat on Thursday?

Jari

---

From: [email-masked]
Date: Tue, 17 Dec 2013 15:38:33 +0100

David,

Kind regards,
Miriam

[1]

---

From: [email-masked] (Dale R. Worley)
Date: Tue, 17 Dec 2013 21:59:06 -0500 (EST)

> From: [email-masked]
> Date: Tue, 17 Dec 2013 15:38:33 +0100
> Cc: [email-masked], [email-masked], [email-masked], [email-masked]

> active on the urn-nid list did not share your concerns.

I believe that you do not fully grasp the social dynamics -- the
de-facto constitution -- of the IETF.  In this instance, the "URN
experts" perform one round of evaluation of the proposal, from their
particular point of view.  But the approval of the IETF as a whole for
URN matters is not *delegated* to the URN experts; the IETF as a whole
must independently achieve consensus that this is a desirable
proposal.

In regard to the objections raised regarding the proposed namespace, I
will extract a portion of your message and then expand on it in a way
that I think expresses your intention, but in a way that more directly

> identified, and the URNs to be resolved on the public Internet.

What it seems to me that you are saying is that in the ordinary usage
of these URNs, they will be confined to particular VPNs that are
tightly associated with the Eurosystem.  (Of course, the usage may be
expanded in the future.)  But even initially, there are expected to be
situations where, at least for particular URNs and particular messages
containing those URNs, it is necessary to be able to identify in much
more public contexts that the URNs have particular defined
(standardized) meanings.

At least, this is the meaning I attribute to your use of
"transparency": that various facts can be established *to outsiders*.

And if it is true that the meanings of these URNs must be provable to
outsiders, outsiders who at least partially operate on the global
Internet, then this is a reason to establish a formal registration of
the URN namespace.

Dale