Subject: [clue] Stephen Farrell's No Objection on draft-ietf-clue-rtp-mapping-12: (with COMMENT)

From: "Stephen Farrell" <[email-masked]>
Date: Tue, 17 Jan 2017 16:04:56 -0800

Stephen Farrell has entered the following ballot position for
draft-ietf-clue-rtp-mapping-12: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-clue-rtp-mapping/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

- abstract: expanding CLUE (or avoiding the acronym) in the
abstract would be better (some abstract readers won't have
heard of CLUE before).

- section 9: I think the paragraph about RFC6562 should be
reduced to the first sentence only. The rest, if it were
correct (and I'm not sure), ought be part of an update to
6562. That's not just process-crap - I would expect the
state of the art to change here and when it does then the
right place to deal with that will be in an update to 6562.
(And hey, it's been 5 years already since we did that, so
maybe it'd be timely if someone re-checked the state of the
art here?) This could have been, but is not a DISCUSS
ballot, on the basis that if we do update 6562 then we
could have that formally UPDATE this RFC, but requiring
that we remember to do that seems worse than just leaving
it to a putative 6562bis. (And again, could we find someone
to re-check 6562 and perhaps consider if a BCP on the topic
would be a worthwhile thing?)

- Section 9 says: "In multi-party communication scenarios
using RTP Middleboxes; this middleboxes are trusted to
preserve the sessions' security." That is just wrong. The
middleboxes may or may not be trusted (or even known to
exist) by the parties to the call. What you should be
saying is that those middleboxes are REQUIRED, by this
protocol/spec, to not weaken security. (And this one is not
a DISCUSS because the rest of the para mitigates the
horrible first sentence;-)