Subject: [tsvwg] Alissa Cooper's No Objection on draft-ietf-tsvwg-port-use-11: (with COMMENT)

From: "Alissa Cooper" <[email-masked]>
Date: Fri, 24 Apr 2015 15:14:15 -0700

Alissa Cooper has entered the following ballot position for
draft-ietf-tsvwg-port-use-11: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to http://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
http://datatracker.ietf.org/doc/draft-ietf-tsvwg-port-use/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Thanks for addressing my DISCUSS!

---

I think I may have some overlapping comments with Barry, but I wrote this
before I saw his comments, so my apologies.

-- Sec 5:
"Port numbers can also be useful for other purposes."

I would suggest s/useful/used/ because whether the purposes listed in the
previous paragraph (e.g., monitoring, blocking, etc. based on port
number) are considered "useful" is in the eye of the beholder.

-- Sec 7.4:
The term "security" is really vague. It would help to define what is
meant by "security" or "secure service."

-- Sec 7.4 and 7.5:
Both of these sections contain recommendations that are good, but seem
out of place in this document unless they could be made more specific to
port use. The ones that jumped out at me are:

   >> New services SHOULD support security, either directly or via a
   secure transport such as TLS [RFC5246].

   >> Insecure versions of new or existing secure services SHOULD be
   avoided because of the new vulnerability they create.
   
   >> Version support SHOULD be included in new services.

I would say to either remove these or add in the context of what they
have to do with port number assignment (e.g., "Version support SHOULD be
included in new services rather than relying on different port number
assignments for different versions.")

-- Sec 7.7:
"Deployments that use port numbers before deployment complicate IANA
   management of the port number space."

I think this is supposed to say "before assignment" rather than "before
deployment."

-- Sec 7.8:
""Squatting" describes the use of a number from the assigned range in
   deployed software without IANA assignment. It is hazardous because
   IANA cannot track such usage and thus cannot avoid making legitimate
   assignments that conflict with such unauthorized usage.

   Such "squatted" port numbers remain unassigned, and IANA retains the
   right to assign them when requested by applicants."

This is a little confusing -- is the first sentence supposed to say
"unassigned range"? If not, what is the assigned range, and why is IANA
said to retain the right to assign numbers that are already assigned? I
would have thought squatting would be understood as using unassigned
numbers in the system and user ranges.

"In
   particular, any unassigned code from the assigned ranges will be
   assigned by IANA, and any conflict will be easily resolved as the
   protocol designer's fault once that happens (because they would not
   be the assignee). This may reflect in the public's judgment on the
   quality of their expertise and cooperation with the Internet
   community."

This seems a little over-the-top to me. I would suggest:

"IANA may assign any code from the system or user ranges to applicants
that meet all of the relevant criteria, and is not obligated to take into
consideration the existence of squatters when doing so. Squatting is
viewed as uncooperative behavior in the Internet community."