Subject: [core] Stephen Farrell's No Objection on draft-ietf-core-observe-14: (with COMMENT)

From: "Stephen Farrell" <[email-masked]>
Date: Tue, 19 Aug 2014 16:12:05 -0700

Stephen Farrell has entered the following ballot position for
draft-ietf-core-observe-14: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to http://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
http://datatracker.ietf.org/doc/draft-ietf-core-observe/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

- You probably won't want to but I'll ask anyway, just in
case:-) The timing and sizes of notifications could expose
sensitive information to a network attacker even if encrypted.
TLS 1.3 is considering providing padding but TLS 1.2 and
earlier don't really. HTTP/2.0 is also considering allowing
padding. So should CoAP allow for padding in general, and if
so, should this extension also? Or, is there a way to get the
same result by sending out-of-date or other notifications that
won't be accepted by the observer? If so, might it be worth
documenting that? (However, it'd probably be better if both
sides knew what was going on.)

- I expected to see something about DTLS in section 7. Is
there really nothing to be said about session lifetimes or
expiry or keep-alives?  Has anyone tried this protocol over
DTLS in the interops?