[apps-discuss] apps-review team review for draft-melnikov-sieve-external-lists

"Murray S. Kucherawy" <msk@cloudmark.com> Tue, 03 May 2011 05:09 UTC

From: "Murray S. Kucherawy" <msk@cloudmark.com>
To: "apps-discuss@ietf.org" <apps-discuss@ietf.org>, "alexey.melnikov@isode.com" <alexey.melnikov@isode.com>, Barry Leiba <barryleiba@computer.org>, "cyrus@daboo.name" <cyrus@daboo.name>, "aaron@serendipity.cx" <aaron@serendipity.cx>
Date: Mon, 02 May 2011 22:09:06 -0700
Thread-Topic: apps-review team review for draft-melnikov-sieve-external-lists
Thread-Index: AcwJUDoEJ+lqWZL4RTiLJYEf/AcHwg==
Message-ID: <F5833273385BB34F99288B3648C4F06F134331A1F6@EXCH-C2.corp.cloudmark.com>
Accept-Language: en-US
Content-Language: en-US
acceptlanguage: en-US
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Cc: "iesg@ietf.org" <iesg@ietf.org>
Subject: [apps-discuss] apps-review team review for draft-melnikov-sieve-external-lists
Precedence: list

I have been selected as the Applications Area Review Team reviewer for this draft (for background on apps-review, please see http://www.apps.ietf.org/content/applications-area-review-team).

Please resolve these comments along with any other Last Call comments you may receive. Please wait for direction from your document shepherd or AD before posting a new version of the draft.

Document: draft-melnikov-sieve-external-lists
Title: Sieve Extension: Externally Stored Lists
Reviewer: Murray S. Kucherawy
Review Date: May 2, 2011
IETF Last Call Date: n/a
IESG Telechat Date: n/a

Summary: This draft is almost ready for publication as a Standards Track RFC, modulo a few points I'd like to mention below.

Major Issues:
1. Altering list behaviour based on data available external to the Sieve processing code means alteration of such data presents a vector for attack. The Security Considerations section should mention this. It does mention some related issues (e.g., authentication) but not the one I have in mind, namely that the outcome of the Sieve script becomes dependent on external data not necessarily under direct control of the user.

Minor Issues:
1. Since the document references the possibility of storing lists in external relational databases, I was surprised not to see a specific reference to how one might be used. Is it the case that no URI schema exists yet for referring to, say, an SQL query? If such does exist, an example of this would be good to include, but certainly not required (especially if such a schema has yet to be registered).

Nits:
1. ":list" is sometimes quoted in the document and sometimes not. It should be consistent throughout.

Apart from those, it's pretty clean. Nicely done!

-MSK

[apps-discuss] apps-review team review for draft-… Murray S. Kucherawy
Re: [apps-discuss] apps-review team review for dr… Barry Leiba
Re: [apps-discuss] apps-review team review for dr… Murray S. Kucherawy
Re: [apps-discuss] apps-review team review for dr… Alexey Melnikov