Subject: [sipcore] Kathleen Moriarty's No Objection on draft-ietf-sipcore-status-unwanted-05: (with COMMENT)

From: Kathleen Moriarty <[email-masked]>
Date: Tue, 25 Apr 2017 20:09:27 -0700

Kathleen Moriarty has entered the following ballot position for
draft-ietf-sipcore-status-unwanted-05: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-sipcore-status-unwanted/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

I agree with EKR's comment and would like to see additional security
considerations that spell out the dangers of not sending this over secure
network or without mutual authentication (MiTM attack he describes).  

I just noticed the text called out by the SecDir review and would like to
know if the following change could be made since it is just part of a
list of examples:
OLD:
   or report the calling party identity to consumer
   complaint databases operated by government authorities.
NEW:
   or report the calling party identity to consumer
   complaint databases.
It doesn't seem necessary to call out government authorities here and
there is the potential for abuse with such databases (government or
otherwise managed).

I was glad to see the explanation for the existence of this draft in the
shepherd report and ballot text, but think the explanation should be in
the draft as well.  I was curious about implementations as there is the
potential for trouble with this option.  It seems like it should be
experimental first, but I guess we could always make it historic later if
unforeseen problems arise.

---

From: Henning Schulzrinne <[email-masked]>
Date: Wed, 26 Apr 2017 15:55:27 +0000

I have removed the 'government' part, although they are the ones most likely to arrest scammers...

(The concern about spoofing has also been added based on the earlier comments.)

-----Original Message-----
From: Kathleen Moriarty [mailto:[email-masked]] 
Sent: Tuesday, April 25, 2017 11:09 PM
To: The IESG <[email-masked]>
Cc: [email-masked]; Adam Roach <[email-masked]>; [email-masked]; [email-masked]; [email-masked]
Subject: Kathleen Moriarty's No Objection on draft-ietf-sipcore-status-unwanted-05: (with COMMENT)

When responding, please keep the subject line intact and reply to all email addresses included in the To and CC lines. (Feel free to cut this introductory paragraph, however.)

Please refer to https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_iesg_statement_discuss-2Dcriteria.html&d=DwICaQ&c=y0h0omCe0jAUGr4gAQ02Fw&r=FJcVoDkWM5EiVcV0ReX8lDU1XeHIYRHfarpk4MK59RE&m=AGGSO3WTW1ArG6uVxV-yOumsYzvnj5aEp0aDlCV3suk&s=MVVmJhBFMx-XHkxJW9UaQ6UYaqI6zbmecFQUyV1nklg&e=
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://urldefense.proofpoint.com/v2/url?u=https-3A__datatracker.ietf.org_doc_draft-2Dietf-2Dsipcore-2Dstatus-2Dunwanted_&d=DwICaQ&c=y0h0omCe0jAUGr4gAQ02Fw&r=FJcVoDkWM5EiVcV0ReX8lDU1XeHIYRHfarpk4MK59RE&m=AGGSO3WTW1ArG6uVxV-yOumsYzvnj5aEp0aDlCV3suk&s=-o49VP6b4UQIY30TgGzJB_Yr47VyNNEskTyTejEjEcM&e=