Subject: [bfcpbis] Spencer Dawkins' Yes on draft-ietf-bfcpbis-bfcp-websocket-13: (with COMMENT)

From: "Spencer Dawkins" <[email-masked]>
Date: Tue, 17 Jan 2017 07:47:17 -0800

Spencer Dawkins has entered the following ballot position for
draft-ietf-bfcpbis-bfcp-websocket-13: Yes

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-bfcpbis-bfcp-websocket/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

I have a couple of questions on authentication in this draft.

Does this text,

      Since the WebSocket API does not distinguish between certificate
      errors and other kinds of failure to establish a connection, it
is
      expected that browser vendors will warn end users directly of any
      kind of problem with the server certificate.

apply to any WebSocket-based application?

In this text,

   A floor control server that receives a message over TCP/WS can
   request the use of TCP/WSS by generating an Error message, as
   described in Section 13.8 of [I-D.ietf-bfcpbis-rfc4582bis], with an
   Error code with a value of 9 (use TLS).

is "request" the right word? Or is "require" more accurate, if the server
isn't going to establish a TCP/WS connection?

---

From: "Ram Mohan R (rmohanr)" <[email-masked]>
Date: Mon, 30 Jan 2017 11:24:48 +0000

Hi Spencer,

Thanks for your feedback. Please see inline <Ram>

-----Original Message-----
From: Spencer Dawkins <[email-masked]>
Date: Tuesday, 17 January 2017 at 9:17 PM
To: The IESG <[email-masked]>
Cc: "[email-masked]" <[email-masked]>, "Charles Eckel (eckelcu)" <[email-masked]>, "[email-masked]" <[email-masked]>, "Charles Eckel (eckelcu)" <[email-masked]>, "[email-masked]" <[email-masked]>
Subject: Spencer Dawkins' Yes on draft-ietf-bfcpbis-bfcp-websocket-13: (with COMMENT)
Resent-From: <[email-masked]>
Resent-To: <[email-masked]>, <[email-masked]>, <[email-masked]>, <[email-masked]>, <[email-masked]>, <[email-masked]>
Resent-Date: Tuesday, 17 January 2017 at 9:17 PM

    

    Does this text,

<Ram> Yes. This is nothing specific to BFCP over webSocket. I think perhaps this text is not a right fit for this document. I do see RFC6455 (like in section 7.1.7) already talk about webSocket API and at certain places on indicating failures to users. I will remove this text from this spec.
    
    In this text,

<Ram> I think requires is appropriate here. I will re-word the text to:

NEW:
     A floor control server that receives a message over TCP/WS can
      mandate the use of TCP/WSS by generating an Error message, as
       described in Section 13.8 of [I-D.ietf-bfcpbis-rfc4582bis], with an
       Error code with a value of 9 (use TLS).

    Is the above ok ?

Regards,
Ram