Subject: [Last-Call] Secdir last call review of draft-ietf-ippm-initial-registry-12

From: Paul Wouters via Datatracker <[email-masked]>
Date: Fri, 01 Nov 2019 06:12:36 -0700

Reviewer: Paul Wouters
Review result: Has Issues

I have reviewed this document as part of the security directorate's  ongoing
effort to review all IETF documents being processed by the  IESG.  These
comments were written primarily for the benefit of the  security area
directors.  Document editors and WG chairs should treat these comments just
like any other last call comments.

As this document populates an IANA registry with metrics values, no security
considerations apply. This is stated in the Security Section.

Normally, the IANA considerations are within one section and all other sections
are written as if this has already been done, except with a [TBD] for any value
IANA needs to put in. But this document uses text outside the Iana
Considerations section like:

      "IANA is asked to assign different numeric identifiers to each of the two
      Named Metrics."

It is better to rewrite this with clear text stating Name X is assigned value
[TBD]

Similarly, the document has "Change Controller", but the way this is normally
phrased is to be part of the new Registry definition of "Registration
Procedure(s)" which has defined values like "Expert review", "Specification
Required", "First Come First Serve", etc. The document should be changed to
reflect these standard types of policies, and ask IANA to create the Registries
with the standarized procedure terms for updating those registries.

---

From: "MORTON, ALFRED C (AL)" <[email-masked]>
Date: Sun, 3 Nov 2019 19:49:05 +0000

Hi Paul,

Thanks for your review and comments, please see below.

Al

> -----Original Message-----
> From: Paul Wouters via Datatracker [mailto:[email-masked]]
> Sent: Friday, November 1, 2019 9:13 AM
> To: [email-masked]
> Cc: [email-masked]; [email-masked];
> [email-masked]
> Subject: Secdir last call review of draft-ietf-ippm-initial-registry-12
> 
> Reviewer: Paul Wouters
> It is better to rewrite this with clear text stating Name X is assigned value [TBD]
[acm] 
Thanks, I'll be working with IANA reps to resolve issues, too.
This hasn't come in previous IANA reviews, but we'll end
with wording that is clear and your suggestion is a good one.

> Procedure(s)" which has defined values like "Expert review",
> "Specification Required", "First Come First Serve", etc. The document should be changed
> to reflect these standard types of policies, and ask IANA to create the
> Registries with the standardized procedure terms for updating those registries.
> 
[acm] 
I understand that the preferred entries under Change Controller 
are under discussion, and we are holding for guidance there.
In the Registry procedures, we currently call-out Expert Review
for the Registration Procedure, and it seems we may change to 
Specification Required.  Again, discussion with IANA will determine
the answer - the authors want this be as IANA-friendly as possible.