Hello Leif, Thanks a lot for reviewing the draft. We have submitted revision -12 (https://datatracker.ietf.org/doc/draft-ietf-insipid-logme-marking/) which makes the "must" normative in the first paragraph of 8.4.6 User Control of Logging, as per the review comment. 8.4.6. User Control of Logging Consent to turn on "log me" marking for a given session MUST be provided by the end user or by the network administrator. Best regards, Peter and Arun > -----Original Message----- > From: Leif Johansson <leifj@xxxxxxxx> > Sent: 09 July 2018 16:16 > To: secdir@xxxxxxxx > Cc: draft-ietf-insipid-logme-marking.all@xxxxxxxx; insipid@xxxxxxxx; > ietf@xxxxxxxx > Subject: Secdir last call review of draft-ietf-insipid-logme-marking-11 > > Reviewer: Leif Johansson > Review result: Ready > > I have reviewed this document as part of the security directorate's ongoing > effort to review all IETF documents being processed by the IESG. These > comments were written primarily for the benefit of the security area > directors. Document editors and WG chairs should treat these comments > just like any other last call comments. > > >From the abstract: This document describes an indicator for the SIP > protocol which can be used to mark signaling as being of interest to logging. > > The document is clearly written and feels ready for publication from a quality > standpoint. > > My only issue is in 7.4.6 - User Control of Logging: Why is the "must" > in the first paragraph non-normative? Is it because there is no way to prove > the existence or absence of user consent? I realize this may be a hard > problem to solve but if this issue was considered and rejected it might be > worth including a discussion about this in the document. >
