Subject: [Gen-art] Gen-ART LC review of draft-ietf-appsawg-webfinger-11.txt

From: Brian E Carpenter <[email-masked]>
Date: Sat, 16 Mar 2013 16:31:53 +0000

Please see attached review.

     Brian

---

From: Barry Leiba <[email-masked]>
Date: Sat, 16 Mar 2013 13:39:03 -0400

> Please see attached review.

I'll counter-complain (see below) that you're the only GenART reviewer
who sends reviews as attachments, and I find it a PitA.

> The draft was updated during Last Call, which I thought was not normal
> practice.  This review is of the updated draft, not the one that was Last
> Called.

I asked the authors to post it, so reviewers would be seeing the
latest version.  Now that we have the datatracker, this really should
not be a problem, and as a reviewer I appreciate not reviewing a
version with issues that others have already caught.

> There is no explicit discussion of privacy in the draft, which seems to
> me to carry evident privacy risks. For example, imagine an ISP that
> kindly decides to support webfinger for all customers by default,
> and preloads personally identifiable information without consent.

There's quite a bit of discussion in the Security Considerations of
personal information, revealing a user's current context, and so on.

> There is some relevant text in the Security Considerations:

Indeed.

> However, the weakness there is the words "or implicitly". IANAL, but it
> seems highly likely that would be illegal in the European Union, at least.

And we are not lawyers either, and deployers in the EU will need to be
well aware of EU laws.  We shouldn't be telling them about those here.

> Has the draft been validated against the guidelines in
> draft-iab-privacy-considerations?

That'd be the document that's not even in the RFC Editor queue yet?

I don't know whether the authors have read that document; perhaps they
can say.  I did ask the authors to alert Alissa to this document, and
to explicitly ask her to review it.

Barry

---

From: Brian E Carpenter <[email-masked]>
Date: Sun, 17 Mar 2013 08:00:03 +0000

> who sends reviews as attachments, and I find it a PitA.

That depends very much on the recipient's UA. Many UAs don't even blink
at text/plain. The reason I do it is because the reviews are archived as
.txt files so it's a convenience for the archiver.

> version with issues that others have already caught.

I didn't intend that as a complaint, but actually a Last Call is
for a specific version, so a reviewer could easily miss an update.

> well aware of EU laws.  We shouldn't be telling them about those here.

No. But IMHO the draft should dissect that "implicitly" a bit more, to
ensure that implementors and operators don't miss its, er, implications.

> That'd be the document that's not even in the RFC Editor queue yet?

Correct, but it's pretty mature.

> to explicitly ask her to review it.

That would be excellent.

   Brian

---

From: "Romascanu, Dan (Dan)" <[email-masked]>
Date: Sun, 17 Mar 2013 14:52:40 +0000

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On
> Behalf Of Brian E Carpenter
> 
> >> The draft was updated during Last Call, which I thought was not
> >> normal practice.  This review is of the updated draft, not the one
> >> that was Last Called.
> >
> I didn't intend that as a complaint, but actually a Last Call is for a
> specific version, so a reviewer could easily miss an update.
> 

[[DR]] I would actually like to catch on this one and support Brian here. I believe that updates during the IETF Last Call should be discouraged. While I was an AD I had always advised the shepherds and authors of the documents I was sponsoring that the I-Ds need to be considered as frozen while in Last Call, so that all reviews are being made on the same baselined version noted in the Last Call announcement and revisions made on all comments (including directorates) only after the Last Call period ends. 

Regards,

Dan

---

From: "Paul E. Jones" <[email-masked]>
Date: Wed, 20 Mar 2013 20:59:53 -0400

Brian,

> Major Issues:  
> -------------

Barry commented on this indicating it is there.  Per Dave's advice, I think we should make it clearer with subsections in the security section.
 
>    Further, WebFinger MUST NOT be used to provide any personal
>    information to any party unless explicitly or implicitly authorized
>    by the person whose information is being shared.
> 

I have no strong preference on this, but "implicit" was asked by some, since (as an example), your information might be shared via WebFinger inside a company for company use.
 
> draft-iab-privacy-considerations?

I have not, but Alissa was asked to weigh in (and she did).  I trust she provided recommendations.  (I've not gotten that far down the stack, yet.)

Paul

---

From: Brian E Carpenter <[email-masked]>
Date: Thu, 28 Mar 2013 07:53:10 +0000

I'm happy with the changes in the -12 draft.

Thanks
   Brian Carpenter