Subject: Re: [rtcweb] Kathleen Moriarty's No Objection on draft-ietf-rtcweb-overview-18: (with COMMENT)

From: Sean Turner <[email-masked]>
Date: Tue, 16 May 2017 12:36:50 -0400

> On Apr 25, 2017, at 15:01, Kathleen Moriarty <[email-masked]> wrote:
> 
> 
> ----------------------------------------------------------------------
> COMMENT:
> ----------------------------------------------------------------------
> 
> Thanks for your work on this draft, it's a helpful overview.  I see the
> reasoning in the shepherd report for informational, but am curious if the
> standards track status is needed for other SDOs that might reference this
> document?  

Addressed via discussions with Ben/Adam.

> In reading sections 8 & 9, I would think the presentation and control in
> section 8 would have the privacy implications of the second bullet in
> section 9.  As such, it seems odd that normative language is used in this
> bullet and not in section 8.  I'd be fine with no normative language in
> either as long as the protocol drafts cover that appropriately.  Some
> mention of privacy in section 8 could be helpful since it covers more
> ground than the example in section 9.

I’m looking at it this way: s8 is really also about local system support functions too.  We could reorder s8 and s9, but I’m hoping that thinking about s8 as a local support functions is sufficient.

> Security considerations: I don't see anything listed for security or
> privacy considerations in respect to the signaling channel to the
> web/application server.  Should there be considerations listed?  Security
> of the actual server and content on the server as well as vulnerabilities
> in listening protocols are just a few of the questions that come to mind.
> If it doesn't matter, please let me know.  I appreciate the comment on
> the browser being target rich as they have been in many attacks to gain
> entry into networks leveraging established outbound sessions.  Maybe this
> is covered in I-D.ietf-rtcweb-security and if so (have not had a chance
> to review it yet), a high-level mention of gateway security here might be
> helpful.

The security considerations and privacy considerations are addressed the two (cough) now expired security drafts:
(cough) now expired security drafts:
https://www.ietf.org/archive/id/draft-ietf-rtcweb-security-arch-12.txt
https://www.ietf.org/archive/id/draft-ietf-rtcweb-security-08.txt
The Security Considerations points to draft-ietf-rtcweb-security, which will get you to the other draft. Instead of recreating all of that here, I’m basically asking for your patience until these drafts make it to the IESG in the next couple of months.  There’s a huge, and I mean Donald Trump “yugeee”, cluster of drafts that can’t go anywhere until those the security drafts get through the process so I hoping until then you’ll be satisfied sharpening your weapons of mass DISCUSSion until then ;)

> I agree with Warren's comment about the management aspects being covered
> here since it is an overview document.  It could be a very helpful
> consideration for protocol developers that may devise new ways to enable
> management as a result of understanding the issues.

Addressed via PR:
https://github.com/rtcweb-wg/rtcweb-overview/pull/15

> I had to look up jingle and BOSH, you may want to consider adding
> references to the XMPP specifications.

Hmm there are references to XMPP and Jingle in the draft.  BOSH, I had to look up too ;). Added a reference via the following PR:
https://github.com/rtcweb-wg/rtcweb-overview/pull/33

spt

---

From: Kathleen Moriarty <[email-masked]>
Date: Tue, 16 May 2017 12:44:31 -0400

Hi Sean,

Thanks very much for your response to my comments.  The solutions all
look good and I appreciate the updates that were made.

> I’m looking at it this way: s8 is really also about local system support functions too.  We could reorder s8 and s9, but I’m hoping that thinking about s8 as a local support functions is sufficient.

That's fine, this was just a comment anyway. Thanks.

> The Security Considerations points to draft-ietf-rtcweb-security, which will get you to the other draft. Instead of recreating all of that here, I’m basically asking for your patience until these d…

That sounds fine, thank you.

> https://github.com/rtcweb-wg/rtcweb-overview/pull/15

Thanks for that!

> https://github.com/rtcweb-wg/rtcweb-overview/pull/33

Thanks!

-- 

Best regards,
Kathleen