Subject: [calsify] Ben Campbell's No Objection on draft-ietf-calext-caldav-attachments-03: (with COMMENT)

From: Ben Campbell <[email-masked]>
Date: Wed, 16 Aug 2017 15:16:44 -0700

Ben Campbell has entered the following ballot position for
draft-ietf-calext-caldav-attachments-03: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-calext-caldav-attachments/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Loosely related to Mirja's comment:

The abstract mentions why this is informational. That information should be
repeated in the Introduction. It would be helpful to see that expanded (in the
introduction) to explain what the non-standard bits are, and if there are
preferred approaches (whether standards or potential standards.)

- 3.12.2: "Access to the managed attachments store in a calendar object resource
   SHOULD be restricted to only those calendar users who have access to
   that calendar object either directly, or indirectly (via being an
   attendee who would receive a scheduling message)."

Why not MUST? When might it make sense to allow others to access attachments?

---

From: Cyrus Daboo <[email-masked]>
Date: Wed, 16 Aug 2017 19:02:38 -0400

Hi Ben,

--On August 16, 2017 at 3:16:44 PM -0700 Ben Campbell <[email-masked]> 
wrote:

> - 3.12.2: "Access to the managed attachments store in a calendar object
> resource    SHOULD be restricted to only those calendar users who have
> access to    that calendar object either directly, or indirectly (via
> being an    attendee who would receive a scheduling message)."
>

Well there are several different ways in which a calendar user might have 
access to another calendar users' data - such as delegation and sharing. 
But perhaps that is implied by the statement above. How about (with one 
typo fixed too):

   Access to the managed attachments stored in a calendar object resource
   MUST be restricted to only those calendar users who are authorized to
   access that calendar object either directly, or indirectly (via being
   an attendee who would receive a scheduling message).

(If the above is acceptable I will leave it to Ken to make the change since 
he has the "edit token". Or Alexey can add as an RFC editor note.)

-- 
Cyrus Daboo

---

From: Ben Campbell <[email-masked]>
Date: Wed, 16 Aug 2017 20:18:30 -0500

> On Aug 16, 2017, at 6:02 PM, Cyrus Daboo <[email-masked]> wrote:
> 
> Hi Ben,
> 
> --On August 16, 2017 at 3:16:44 PM -0700 Ben Campbell <[email-masked]> wrote:
> 
> Well there are several different ways in which a calendar user might have access to another calendar users' data - such as delegation and sharing. But perhaps that is implied by the statement above. How about (with one typo fixed too):
> 

That works for me. (Although I would have also been happy with a SHOULD along with some guidance on when it might make sense to do otherwise.)

> 
> (If the above is acceptable I will leave it to Ken to make the change since he has the "edit token". Or Alexey can add as an RFC editor note.)
> 
> -- 
> Cyrus Daboo
>

---

From: Alexey Melnikov <[email-masked]>
Date: Thu, 17 Aug 2017 14:39:46 +0100

Cyrus,

On Thu, Aug 17, 2017, at 02:18 AM, Ben Campbell wrote:
> That works for me. (Although I would have also been happy with a SHOULD
> along with some guidance on when it might make sense to do otherwise.)
> 
> > 

I am happy with your proposal as well.