Subject: [mile] Feedback on draft-ietf-mile-xmpp-grid-09

From: Florian Schmaus <[email-masked]>
Date: Thu, 24 Jan 2019 17:44:54 +0100

I know I am late to the party, probably too late, but I had the chance
to take at least a short look at the I-D (which has been on my TODO list
for months). Here are my remarks with my XMPP goggles on, I hope they
are still helpful.

Section 6: The first reference should point to XEP-0060 not XEP-0030.

XMPP-Grid uses XEP-0060 (and XEP-0030) at its core. There are two size
limitations you may want to consider:
1. XEP-0060, unfortunately, does not specify a maximum PubSub node name
length. If your XMPP-Grid use case allows it, then you may want to
specify a maximum node name size. If you do so, then implementations
claiming compatibility with XMPP-Grid are required to support this
maximum node name size. I believe this would improve interoperability.
2. Requesting all topics using XEP-0030 could potentially return a huge
result set. It could become so large, that it exceeds the maximum stanza
size limit of an involved party. In XMPP we have XEP-0059 "Result Set
Management" to split (large) result sets into smaller ones.
Unfortunately using XEP-0030 with XEP-0059 is underspecified (AFAIKT).
Nevertheless, if you anticipate a large number of topics, then you may
want to hint towards the problematic and XEP-0059 as a potential solution.

XEP-0059 is also the XMPP-ish mitigation against the type of resource
exhaustion attacks mentioned in § 8.3.5. Referencing XEP-0059 in this
section appears sensible.

As others already pointed out, I also wondered why the I-D requires
exclusive usage of SASL EXTERNAL and SASL SCRAM, as opposed to making
those two only MTI. Changing one "MUST" into a weaker keyword probably
fixes that.

If SCRAM-SHA1 is MTI (+1), then shouldn't RFC 5802 be a normative
reference and not an informative one?

Best wishes
 Florian