Subject: [secdir] Secdir review of draft-sparks-genarea-mailarch-improvements-02

From: Charlie Kaufman <[email-masked]>
Date: Thu, 4 Feb 2016 19:28:43 +0000

I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG.  These comments were written primarily for the benefit of the security area directors.  Document editors and WG chairs should treat these comments just like any other last call comments.

This is an unusual RFC candidate - even as informational - in that it is effectively a wish list for improvements to the IETF's "mailarch" tool for searching email archives. It's not quite a requirements document, but rather seems to describe a well developed design, as indicated by stating that the new version should work without requiring JavaScript on the client, but that in that mode would give up certain enumerated features.

Since all of the archives are public, and the search engine should only have the right to read them, the only significant security considerations are with respect to denial of service. That issue is briefly raised in RFC 6778, which this document references.

                --Charlie