Subject: [dns-privacy] Murray Kucherawy's No Objection on draft-ietf-dprive-xfr-over-tls-11: (with COMMENT)

From: Murray Kucherawy via Datatracker <[email-masked]>
Date: Wed, 05 May 2021 23:18:27 -0700

Murray Kucherawy has entered the following ballot position for
draft-ietf-dprive-xfr-over-tls-11: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-dprive-xfr-over-tls/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

With my BCP 14 language complainer hat on:

Section 7:

* "Implementations SHOULD use [RFC7828] [...] to manage persistent
connections." -- since this is a SHOULD, can you suggest why an implementer
might opt not to do this?  Section 7.3.1 does a great job of handling the
SHOULD it presents, for example.

Sections 7.3.2 and 7.3.3:

* Same issue as above with the SHOULDs here.

Section 7.4:

* "Therefore, it is RECOMMENDED that [...] there SHOULD be no more than [...]."
-- I don't know how to reconcile this RECOMMENDED-SHOULD combination in the
same sentence.  I suggest that the first clause can be dropped with no loss of
meaning.

Everything else is nits, some of which were probably also mentioned by others:

Section 1:

* "authoritatives" should probably be "authoritative nameservers"

* "authenticated denial of existences records" -- s/existences/existence/

Section 4:

* "The proposed mechanisms does not attempt" -- s/does/do/, or
s/mechanisms/mechanism/

Section 6:

* "term is used to encompasses" -- s/encompasses/encompass/, or remove "is used
to"

Sections 6.1 and 6.2

* "higher than the secondaries serial" -- s/secondaries/secondary's/

Section 6.2:

* "So there may be a fourth step above where [...].  There may also be a fourth
step where [...]." -- so there can be two "fourth" steps?

Section 6.3:

* "This section attempts to presents" -- remove "attempts to", or
s/presents/present/

* In the second paragraph, I think you need a comma after "servers".

---

From: Sara Dickinson <[email-masked]>
Date: Thu, 6 May 2021 12:53:21 +0100

> On 6 May 2021, at 07:18, Murray Kucherawy via Datatracker <[email-masked]> wrote:
> 

Implementations typically include an option to use fixed timeouts on either side of a connection for simplicity which can work just fine for e.g., low transfer rates - I could add text to that effect?

> * Same issue as above with the SHOULDs here.

Short answer, backwards compatibility.

For 7.3.2 there was a discussion in the working group about the significant code complexity involved for several implementations to meet all 3 requirements (particularly the second two points).  Since the performance improvements gained from these features is desirable, but not a critical for XFR, the discussion resulted in the SHOULD. Again, could add text on that if needed?

For 7.3.3, there is no previous specification for this behaviour and nameservers may behave differently today, hence the SHOULD here. 

> same sentence.  I suggest that the first clause can be dropped with no loss of

Double checking this I remembered that for consistency the text is actually lifted and tweaked from RFC7766 which it is updating which said:
“It is RECOMMENDED that for any given
   client/server interaction there SHOULD be no more than one connection
   for regular queries, one for zone transfers, and one for each
   protocol that is being used on top of TCP (for example, if the
   resolver was using TLS). "

So we could update it if you feel very strongly?

> * In the second paragraph, I think you need a comma after "servers”.

Thanks for these - some but not all were caught by others!

Regards

Sara.

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Thu, 6 May 2021 07:19:22 -0700

On Thu, May 6, 2021 at 4:53 AM Sara Dickinson <[email-masked]> wrote:

> Implementations typically include an option to use fixed timeouts on
> either side of a connection for simplicity which can work just fine for
> e.g., low transfer rates - I could add text to that effect?
>

Yes, something that rounds out this SHOULD story would be great.

> For 7.3.2 there was a discussion in the working group about the
> significant code complexity involved for several implementations to meet
> all 3 requirements (particularly the second two points).  Since the
> performance improvements gained from these features is desirable, but not a
> critical for XFR, the discussion resulted in the SHOULD. Again, could add
> text on that if needed?
>

Adding something like that would be helpful, yes.

For 7.3.3, there is no previous specification for this behaviour and
> nameservers may behave differently today, hence the SHOULD here.
>

Same.

> Double checking this I remembered that for consistency the text is
> actually lifted and tweaked from RFC7766 which it is updating which said:

Alas, no.  If you're copying this from something that already has
consensus, it's probably best to leave it.  Thanks for checking.

-MSK