Subject: [rtcweb] Kathleen Moriarty's No Objection on draft-ietf-rtcweb-overview-18: (with COMMENT)

From: Kathleen Moriarty <[email-masked]>
Date: Tue, 25 Apr 2017 12:01:32 -0700

Kathleen Moriarty has entered the following ballot position for
draft-ietf-rtcweb-overview-18: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-rtcweb-overview/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Thanks for your work on this draft, it's a helpful overview.  I see the
reasoning in the shepherd report for informational, but am curious if the
standards track status is needed for other SDOs that might reference this
document?  

In reading sections 8 & 9, I would think the presentation and control in
section 8 would have the privacy implications of the second bullet in
section 9.  As such, it seems odd that normative language is used in this
bullet and not in section 8.  I'd be fine with no normative language in
either as long as the protocol drafts cover that appropriately.  Some
mention of privacy in section 8 could be helpful since it covers more
ground than the example in section 9.

Security considerations: I don't see anything listed for security or
privacy considerations in respect to the signaling channel to the
web/application server.  Should there be considerations listed?  Security
of the actual server and content on the server as well as vulnerabilities
in listening protocols are just a few of the questions that come to mind.
 If it doesn't matter, please let me know.  I appreciate the comment on
the browser being target rich as they have been in many attacks to gain
entry into networks leveraging established outbound sessions.  Maybe this
is covered in I-D.ietf-rtcweb-security and if so (have not had a chance
to review it yet), a high-level mention of gateway security here might be
helpful.

I agree with Warren's comment about the management aspects being covered
here since it is an overview document.  It could be a very helpful
consideration for protocol developers that may devise new ways to enable
management as a result of understanding the issues.

I had to look up jingle and BOSH, you may want to consider adding
references to the XMPP specifications.

---

From: Ben Campbell <[email-masked]>
Date: Tue, 25 Apr 2017 14:23:02 -0500

> On Apr 25, 2017, at 2:01 PM, Kathleen Moriarty <[email-masked]> wrote:
> 

I’m a bit confused—I thought this was standards track. Did I miss some intent to make it informational?

Thanks!

Ben.

---

From: Kathleen Moriarty <[email-masked]>
Date: Tue, 25 Apr 2017 15:49:40 -0400

> I’m a bit confused—I thought this was standards track. Did I miss some intent to make it informational?

I reworded what I had stated and didn't correct the rest of the
sentence, sorry for the confusion.  It seems more like an
informational draft and my intent here was to see if there is any
other reasoning beyond what's in the shepherd report for standards
track.  Since this set of standards includes some from other SDOs, I
was wondering if there was a requirement for their reference to this
draft.

Thanks,
Kathleen

-- 

Best regards,
Kathleen

---

From: Ben Campbell <[email-masked]>
Date: Tue, 25 Apr 2017 14:55:09 -0500

> On Apr 25, 2017, at 2:49 PM, Kathleen Moriarty <[email-masked]> wrote:
> 

As I mentioned in response to Mirja’s comments, I think standards track is appropriate for this. It’s not just a matter of this having 2119 language; I think the _specific_ 2119 language needs to be as PS. We’re not talking about using MUSTs to describe requirements for the protocol, or requirements for operational practices—it states specific requirements for implementations.

Thanks!

Ben.

---

From: Kathleen Moriarty <[email-masked]>
Date: Tue, 25 Apr 2017 15:59:46 -0400

> As I mentioned in response to Mirja’s comments, I think standards track is appropriate for this. It’s not just a matter of this having 2119 language; I think the _specific_ 2119 language needs to b…

Hi Ben,

Hmm, I'm not arguing, I'm asking if there are other reasons besides
those stated in the shepherd report to fully understand the decision
and to assist with IESG discussions on support drafts like this one.
We've had cases where some other SDOs needed our publications to be
standards track in order for them to reference the specifications.
Since this publication could be referenced by W3C and possibly others,
I am just asking if that is a consideration.

Thanks,
Kathleen

-- 

Best regards,
Kathleen

---

From: Adam Roach <[email-masked]>
Date: Tue, 25 Apr 2017 15:03:05 -0500

> I am just asking if that is a consideration.

I do not believe citation by other SDOs was a specific consideration in 
this case, although I may have missed some early discussions on the topic.

/a

---

From: Ben Campbell <[email-masked]>
Date: Tue, 25 Apr 2017 15:04:07 -0500

> On Apr 25, 2017, at 2:59 PM, Kathleen Moriarty <[email-masked]> wrote:
> 

Ah, I see. Sorry for the confusion. Also, I will leave that question for Adam and/or the chairs. (Since I don’t know, either :-)  )

Ben.

---

From: Kathleen Moriarty <[email-masked]>
Date: Tue, 25 Apr 2017 16:05:34 -0400

> Ah, I see. Sorry for the confusion. Also, I will leave that question for Adam and/or the chairs. (Since I don’t know, either :-)  )

Thanks Adam & Ben.

-- 

Best regards,
Kathleen

---

From: Sean Turner <[email-masked]>
Date: Tue, 25 Apr 2017 21:54:03 -0500

> On Apr 25, 2017, at 14:55, Ben Campbell <[email-masked]> wrote:
> 
> 

I wrote the write-up and it’s as Ben sees it.  That is, the draft states specific requirements for implementations.  As I noted, there are only a few of them, but that’s why PS.

spt

---

From: Kathleen Moriarty <[email-masked]>
Date: Tue, 25 Apr 2017 23:11:26 -0400

> I wrote the write-up and it’s as Ben sees it.  That is, the draft states specific requirements for implementations.  As I noted, there are only a few of them, but that’s why PS.

Thanks on that question.  Good to know there were no other motivations.

-- 

Best regards,
Kathleen