Subject: [secdir] Secdir review of draft-ietf-sieve-convert-05

From: Vincent Roca <[email-masked]>
Date: Wed, 30 Nov 2011 18:44:29 +0100

Hello,

I have reviewed this document as part of the security directorate's
ongoing effort to review all IETF documents being processed by the
IESG.  These comments were written primarily for the benefit of the
security area directors. Document editors and WG chairs should treat
these comments just like any other last call comments.

The authors explain there is no additional security considerations resulting
from combining  the two technologies. I'm not an expert in the domain and I
have no strong opinion on this claim. So let's trust the authors.

However these technologies do have strong security implications, as
explained in [RFC5259] and [RFC5228]. So the authors should perhaps
highlight this and be more directive.

Regards,

 Vincent

---

From: Barry Leiba <[email-masked]>
Date: Wed, 30 Nov 2011 16:13:02 -0500

Hi, Vincent, and thanks for the review.

> highlight this and be more directive.

They do, indeed, and those documents do explain it.  I believe the
text that's here is customary and adequate.  That said, I have no
objection to adding a sentence or two that says, "No, really.  Pay
attention!", or perhaps something slightly less flippant.  If the ADs
want that, please let me know and we'll work something up.

Barry