Subject: Re: [appsdir] IANA consideration help

From: Claudio Allocchio <[email-masked]>
Date: Sat, 17 May 2014 17:51:05 +0200 (CEST)

Hello Morteza,

On Sat, 17 May 2014, Morteza Ansari (moransar) wrote:

> Hi Claudio,
>
> Barry suggested I ping you and ask for someone to help us with the 
> review of the IANA consideration for the SCIM documents.  In discussion 
> regarding this a few questions came up and we could use some help in 
> better understanding a few key points and then get help with the review 
> of the text.  Thanks for your help.

sure!

I guess the best way to do this is to ask a review to the AppsDir folks, 
which I already copy in here.

Do you have a specific list of drafts already? thus we do not forget some?

best!
> Cheers,
> Morteza

------------------------------------------------------------------------------
Claudio Allocchio             G   A   R   R          [email-masked]
                         Senior Technical Officer
tel: +39 040 3758523      Italian Academic and       G=Claudio; S=Allocchio;
fax: +39 040 3758565        Research Network         P=garr; A=garr; C=it;

            PGP Key: http://www.cert.garr.it/PGP/keys.php3#ca

---

From: Claudio Allocchio <[email-masked]>
Date: Mon, 19 May 2014 17:11:35 +0200 (CEST)

On Mon, 19 May 2014, Morteza Ansari (moransar) wrote:

> Thanks Claudio.  There are two documents:
>
> http://tools.ietf.org/wg/scim/draft-ietf-scim-core-schema/
> http://tools.ietf.org/wg/scim/draft-ietf-scim-api/
>
> However, I don¹t think they are quite ready for review.  The editors had a
> few questions about IANA consideration and wanted to get a contact to ask
> for some suggestion/advise.  If [email-masked] is the right place to ask
> for advise, I can certainly point them to that.

well, the AppsDir is a grop of people which has quite some exoerience in 
various fields; thus, apart for doing semi-formal reviews, we can be also 
helpful for suggestions/advices in general... :-)

yes, please, point them here.

  >
>
> Cheers,
> Morteza
>
> On 5/17/14, 8:51 AM, "Claudio Allocchio" <[email-masked]> wrote:
>
>>
>> Hello Morteza,
>>

---

From: "Morteza Ansari (moransar)" <[email-masked]>
Date: Mon, 19 May 2014 15:06:44 +0000

Cheers,
Morteza

---

From: Barry Leiba <[email-masked]>
Date: Tue, 20 May 2014 13:08:11 -0400

> However, I don't think they are quite ready for review.  The editors had a

For now, let me give a couple of comments that come from a quick look
(feel free to send this to the authors and/or post it to the scim

> http://tools.ietf.org/wg/scim/draft-ietf-scim-api/

This registers a media type, and so it's important to post a review
request to the media-types list:
https://www.ietf.org/mailman/listinfo/media-types
Doing that sooner is better than doing it later.

I note that the document is using an old template, rather than the one
from RFC 6838.  Apart from the unnecessary first two lines ("To" and
"Subject"), the substantive difference is that you need to add
"Fragment identifier considerations" to the template.

> http://tools.ietf.org/wg/scim/draft-ietf-scim-core-schema/

Expect to get strong pushback from me on the registration policy in
Section 14.1.1.  Yes, I know this was copied from somewhere else; I
can tell.  Don't assume that what was used in some other RFC is either
good or appropriate for SCIM.

   Registration of new schemas MUST be reviewed by the designated expert
   and published in an RFC.  A Standards Track RFC is REQUIRED for the
   registration of new value data types that modify existing properties.
   A Standards Track RFC is also REQUIRED for registration of SCIM
   schema URIs that modify SCIM schema previously documented in a
   Standards Track RFC.

You have, essentially, Specification Required specified, without
saying it.  Then beyond that you (1) require that the specification be
an RFC, and (2) that it be a Standards Track RFC in certain rather
vaguely specified cases.

Why?

Why is Specification Required not right?  Why can we not rely on the
Designated Expert, and instead say that we have to have the entire
IETF community review it?  Why do we require an RFC, rather than
allowing, say, some other SDO to publish a spec and register it?

(Note that this is asking for discussion: I'm not saying that what's
there is wrong; I'm asking questions that are intended to start a
discussion, and the result of that discussion will be what belongs
here in this policy.)

Then in the next paragraph, I can see where the text was copied from,
because it still says <[email-masked]>.  Let me say that vcarddav
is a particularly bad example to copy from: we've already regretted
painting ourselves into the Standards Track corner there.  Please
don't make the same mistake.

Remember that the goal is to make it easy to register reasonable
things, and to strongly encourage the registration of them... while
having some sort of review that at least checks that what's being
registered is reasonable.  Very strict registration policies are
needed when you have limited code points (16 bits to dole out), or
when some stupid idea will cause a lot of damage.  In most cases, we
don't need that.

You should also pull out the details of what IANA does, how to appeal
decisions, and such -- let normal policies work.  Instead, directions
to the Designated Expert about what she should be looking at are very
important.  Assume that five years from now, someone who wasn't around
now is appointed as a DE, and that expert needs to have guidance.
What criteria merit a "no"?  Is the review just a sanity check, or is
something more rigorous expected?

In Section 14.1.2 you have the registration template, and you've
already said, "An RFC specifying new schema URI MUST include the
completed registration templates."  Yet the initial registrations here
don't.  They should: each section from 6 thru 11 should include the
registration template for its schema.

The registration template has 'Intended or Associated Resource Type: A
value defining the resource type (e.g. "Device").'  OK, "Device" is an
example of what can be here... but can this be anything at all?  Can I
put "Frobozz" or "Banana" here?  If so, you should say so.  If not,
you should say the sort of thing that's expected.  Do you want this to
be a choice from a set of strings, such that a separate registry for
these should be created?

Bary