Subject: [EAI] POP/IMAP documents: IESG Evaluation

From: Pete Resnick <[email-masked]>
Date: Thu, 4 Oct 2012 14:33:14 -0700

Folks,

There are a couple of outstanding DISCUSS positions from Russ and Benoit 
during the IESG Evaluation on the IMAP/POP documents. I think I 
understand the issue, and after discussion today I think we have an easy 
solution, but I want to confirm with the WG that this still represents 
our consensus.

The issue is with the status of the downgrade documents and how we refer 
to them. I believe the consensus of the WG was that we want to 
standardize the downgrade documents because they are the result of 
extensive technical review, with the outcome being safe and appropriate 
ways to do downgrading. In particular, if you are going to downgrade, 
the potential for doing something that does damage (by making a 
replyable From address that leaks onto the net, or leaking information 
that becomes a vector of attack) is high enough that you had better know 
what you're doing when you downgrade. So we decided standards track was 
appropriate, and I agree. However, it is also perfectly clear that there 
are other ways you could conceivably downgrade in a safe manner, these 
were just two ways to do it that got proper vetting. So we didn't want 
to make either of these REQUIRED for the POP or IMAP documents.

However, this left Russ an Benoit a bit confused: If there was the 
potential for damage if you chose the wrong one, shouldn't these somehow 
be required? And if not, aren't they just examples that could just be 
informational documents? After quite a bit of discussion, I think I (and 
Barry) now understand the issues, and it mostly comes down to how we 
refer to the two documents.

An analogy that helped during our discussion in the IESG was TCP 
congestion control: Congestion control is much the same in the sense 
that the receiver can't really tell which congestion control algorithm 
the sender used, and there are likely many ways to set timers and other 
parameters and still get it right, but if the sender does it wrong, bad 
things happen. However, it is also clear that the defined ways of doing 
congestion control are well understood and tested, and it behooves you 
to use the currently defined ones unless you really know what you are 
doing. They aren't just examples; getting this stuff right is hard, and 
you should trust us that we've got the right algorithm.

So, the suggested change to the EAI documents is (a) to add language to 
both 5721bis and 5738bis that says that *if* you're going to do 
downgrading, you SHOULD implement one of the algorithms in 
popimap-downgrade or simpledowngrade (perhaps with a specific line that 
says, "This stuff is hard to get right, and these two standards track 
documents are two ways that we worked out that are well understood); and 
(b) to change the references from informative to normative (because if 
you don't want to hide the message or refuse to serve it up, you do need 
to go look at these documents to see how to do downgrading safely). Russ 
and Benoit have me pretty convinced that this is the appropriate way to 
go; it makes it clear that these are the well-vetted options, but leaves 
the out clause (via the SHOULD) that there are other potential 
algorithms that you could come up with if you knew what you were doing.

Does anyone object to going forward this way?

pr

-- 
Pete Resnick<http://www.qualcomm.com/~presnick/>
Qualcomm Technologies, Inc. - +1 (858)651-4478

---

From: "Martin J. Dürst" <[email-masked]>
Date: Fri, 05 Oct 2012 19:10:50 +0900

Just to make sure we have finally move ahead: I don't object to your 
proposal at all. If Russ and Benoit are going to be happy that way, 
that's great, and I think it says all we want to say.

Regards,   Martin.

P.S.: I really like the congestion control example. Who came up with that?

---

From: Alexey Melnikov <[email-masked]>
Date: Fri, 05 Oct 2012 11:58:12 +0100

On 04/10/2012 22:33, Pete Resnick wrote:
> Folks,
>
> There are a couple of outstanding DISCUSS positions from Russ and 
> Benoit during the IESG Evaluation on the IMAP/POP documents. I think I 
> understand the issue, and after discussion today I think we have an 
> easy solution, but I want to confirm with the WG that this still 
> represents our consensus.
>
> The issue is with the status of the downgrade documents and how we 
> refer to them. I believe the consensus of the WG was that we want to 
> extensive technical review, with the outcome being safe and 
> appropriate ways to do downgrading. In particular, if you are going to 
> downgrade, the potential for doing something that does damage (by 
> making a replyable From address that leaks onto the net, or leaking 
> information that becomes a vector of attack) is high enough that you 
> had better know what you're doing when you downgrade. So we decided 
> standards track was appropriate, and I agree. However, it is also 
> perfectly clear that there are other ways you could conceivably 
> downgrade in a safe manner, these were just two ways to do it that got 
> proper vetting. So we didn't want to make either of these REQUIRED for 
> the POP or IMAP documents.
>
> potential for damage if you chose the wrong one, shouldn't these 
> somehow be required? And if not, aren't they just examples that could 
> just be informational documents? After quite a bit of discussion, I 
> think I (and Barry) now understand the issues, and it mostly comes 
> down to how we refer to the two documents.
>
> the sender used, and there are likely many ways to set timers and 
> other parameters and still get it right, but if the sender does it 
> wrong, bad things happen. However, it is also clear that the defined 
> ways of doing congestion control are well understood and tested, and 
> it behooves you to use the currently defined ones unless you really 
> know what you are doing. They aren't just examples; getting this stuff 
> right is hard, and you should trust us that we've got the right 
> algorithm.
>
> So, the suggested change to the EAI documents is (a) to add language 
> to both 5721bis and 5738bis that says that *if* you're going to do 
> popimap-downgrade or simpledowngrade (perhaps with a specific line 
> that says, "This stuff is hard to get right, and these two standards 
> track documents are two ways that we worked out that are well 
> understood); and (b) to change the references from informative to 
> normative (because if you don't want to hide the message or refuse to 
> serve it up, you do need to go look at these documents to see how to 
> do downgrading safely). Russ and Benoit have me pretty convinced that 
> this is the appropriate way to go; it makes it clear that these are 
> the well-vetted options, but leaves the out clause (via the SHOULD) 
> that there are other potential algorithms that you could come up with 
> if you knew what you were doing.
>
No, this looks sensible to me.