Subject: [regext] New-AD review of draft-ietf-regext-epp-fees

From: Barry Leiba <[email-masked]>
Date: Fri, 21 Jun 2019 20:40:11 -0400

Hi, all,

Adam did his AD review of this document, and version -16 was posted 5
or 6 weeks ago, which resolved the issues Adam had raised.
Unfortunately, the system didn't inform me that I had an action to
take, so I haven't looked at it.  I now have.

I have only one thing to comment on that Adam didn't, and I won't
delay the last call for it.  But I expect the SecDir review to bring
it up, so it would be good to do another draft revision for it:

The Security Considerations correctly say that this extension provides
no new security services.  But  as this extension involves fees --
money -- it would be good to address whether interfering with this
(faking, altering, intercepting, or blocking) commands or responses
can be used as an attack to affect accounting or money exchanges, or
to compromise privacy or confidentiality, in ways that are specific to
this extension.

Even if you decide that this is not a concern, that the relevant
protocols already defend against such an attack, it's probably good to
mention it so that there's no question.

I will now request Last Call for this document, and thanks for the work on this.

Barry