Brian E Carpenter wrote:
Hi Cyrus,
On 2009-10-13 17:16, Cyrus Daboo wrote:
Hi Brian,
Thank you for your review. Sorry I have been busy on other subjects
these last few weeks and am only now getting around to replying.
--On September 21, 2009 10:34:33 AM +1200 Brian E Carpenter
<[email protected]> wrote:
Major issues:
-------------
I would have liked to see a bit more emphasis on privacy issues in the
Security Considerations. In particular, shouldn't there be a fairly
strong SHOULD obligation on clients to implement TLS and use it by
default? The way the text is written, a client running with no TLS and no
HTTP Basic authentication appears to be allowed.
There are cases where public address books (or a public address service)
can be used, and there is no absolute requirement that TLS be used in
such cases (or maybe the IESG has a requirement that no plain text
whatsoever can be sent in any protocol).
That said I would be OK with adding the following to the end of the
first paragraph in Security Considerations:
Clients SHOULD use TLS whenever possible.
Is that sufficient?
I would be happy with that; it's probably something to be checked with
the WG since it's a change in normative requirements.
I wonder if this needs to be phrased as "Clients MUST implement TLS
support, SHOULD use it"?
On the same lines,
Clients MAY choose to warn users when they create address data in a
public address book, copy or move address data into public address
books, or change access privileges in such a way as to expose address
data to unauthenticated users.
Why isn't that a SHOULD?
I am a little nervous about putting such a requirement on a client.
First of all, what does it really mean to "warn" a user? An alert, an
icon, a noise? Does it happen only the first time they do an action, or
each time? SHOULD seems a little strong when the nature of the warning
is really going to be implementation dependent.
That said, if there is consensus for this change, it may be necessary to
explain a little more what "warn" means.
Yes, that is a problem. I'm not a privacy expert, but it does seem like
something that could one day end up as bad news. ("XYZ Corporation revealed
private data for 27,000 customers, FCC investigation alleges. We just
followed the IETF standard, says XYZ spokesman.") I think it needs a
little thought.
I think SHOULD is better here.
And yes, I think some explanation of what "warns" mean is needed, as
well as some possible description of "remember my answer" checkbox (or
similar).
_______________________________________________
Gen-art mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/gen-art
