Subject: [Gen-art] Gen-ART Last Call review of draft-ietf-appsawg-acct-uri-03

From: Meral Shirazipour <[email-masked]>
Date: Wed, 6 Mar 2013 15:32:17 +0000

I am the assigned Gen-ART reviewer for this draft. For background on Gen-ART, please see the FAQ at <http://wiki.tools.ietf.org/area/gen/trac/wiki/GenArtfaq> .

Please resolve these comments along with any other Last Call comments you may receive.

Document: draft-ietf-appsawg-acct-uri-03
Reviewer: Meral Shirazipour
Review Date: 2013-03-06
IETF LC End Date: 2013-03-06
IESG Telechat date: NA

Summary:
This draft is ready to be published as Proposed Standard but I have some comments.

Nits/editorial comments:
[Page 1] please consider spelling out "URI" in the abstract as in "uniform resource identifier (URI)"
[Page 3] paragraph 4, "method for deferencing", do you mean "dereferencing" ?
[Page 5] Section 5, "..access to personally identifying information..", do you mean "..access to identifiable personal information" ?

Best Regards,
Meral
---
Meral Shirazipour
Ericsson
Research
www.ericsson.com

---

From: Peter Saint-Andre <[email-masked]>
Date: Wed, 6 Mar 2013 09:44:04 -0700

Hi Meral, thanks for your review.

> [Page 1] please consider spelling out "URI" in the abstract as in "uniform resource identifier (URI)"

Will do.

> [Page 3] paragraph 4, "method for deferencing", do you mean "dereferencing" ?

Yes, I'll fix that.

> [Page 5] Section 5, "..access to personally identifying information..", do you mean "..access to identifiable personal information" ?

Looking at draft-iab-privacy-considerations, I think "personal data" might be best.

Peter

---

From: Meral Shirazipour <[email-masked]>
Date: Wed, 6 Mar 2013 16:57:12 +0000

Hi,
  Thank you for considering the comments.

Best Regards,
Meral

From: Peter Saint-Andre [mailto:[email-masked]]
Sent: March-06-13 11:44 AM
To: Meral Shirazipour
Cc: [email-masked]; [email-masked]
Subject: Re: Gen-ART Last Call review of draft-ietf-appsawg-acct-uri-03

Summary:

Nits/editorial comments:

Will do.

Yes, I'll fix that.

Peter

---

From: Barry Leiba <[email-masked]>
Date: Wed, 6 Mar 2013 12:02:24 -0500

>> [Page 5] Section 5, "..access to personally identifying information..", do
>> you mean "..access to identifiable personal information" ?
>

Maybe.  But "PII" is a term of art, and it means something different
to (and more specific than) "personal data".  I'm not sure whether the
change is the right answer in the full context of the paragraph:

   Protocols that make use of 'acct' URIs are responsible for defining
   security considerations related to such usage, e.g., the risks
   involved in dereferencing an 'acct' URI and the authentication and
   authorization methods that could be used to control access to
   personally identifying information associated with a user's account
   at a service.

I suppose, as I mull it over, that changing to "personal data"
probably *is* right.  But people should speak up if they think
otherwise.

Barry

---

From: Peter Saint-Andre <[email-masked]>
Date: Wed, 6 Mar 2013 10:39:32 -0700

> probably *is* right.  But people should speak up if they think

Yes, I think "personal data" is what we really mean here, not personally identifiable information (such as IP addresses and mother's maiden name).

Peter

---

From: Jari Arkko <[email-masked]>
Date: Wed, 27 Mar 2013 09:34:15 +0200

Thank you Meral for the review, and Peter for taking the comments into account.

Jari