Hi James,
please find my replies below.
Il 15/07/2021 19:40, Gould, James ha scritto:
Mario,
My responses are embedded below.
--
JG
*James Gould
*Fellow Engineer
jgo...@verisign.com
<applewebdata://13890C55-AAE8-4BF3-A6CE-B4BA42740803/jgo...@verisign.com>
703-948-3271
12061 Bluemont Way
Reston, VA 20190
Verisign.com <http://verisigninc.com/>
*From: *Mario Loffredo <mario.loffr...@iit.cnr.it>
*Date: *Thursday, July 15, 2021 at 5:31 AM
*To: *James Gould <jgo...@verisign.com>
*Cc: *"regext@ietf.org" <regext@ietf.org>
*Subject: *[EXTERNAL] Fwd: [regext] New Version Notification for
draft-gould-regext-rdap-redacted-00.txt
Hi James,
please find my comments below prefixed by [ML].
-------- Messaggio Inoltrato --------
*Oggetto: *
Re: [regext] New Version Notification for
draft-gould-regext-rdap-redacted-00.txt
*Data: *
Wed, 14 Jul 2021 14:06:47 +0000
*Mittente: *
Gould, James <jgould=40verisign....@dmarc.ietf.org>
<mailto:jgould=40verisign....@dmarc.ietf.org>
*A: *
mario.loffr...@iit.cnr.it <mailto:mario.loffr...@iit.cnr.it>
<mario.loffr...@iit.cnr.it> <mailto:mario.loffr...@iit.cnr.it>,
marc.blanc...@viagenie.ca <mailto:marc.blanc...@viagenie.ca>
<marc.blanc...@viagenie.ca> <mailto:marc.blanc...@viagenie.ca>
*CC: *
regext@ietf.org <mailto:regext@ietf.org> <regext@ietf.org>
<mailto:regext@ietf.org>
Mario,
Thank you for your review and feedback. I provide replies to your
feedback embedded below.
--
JG
James Gould
Fellow Engineer
jgo...@verisign.com <mailto:jgo...@verisign.com>
<applewebdata://13890C55-AAE8-4BF3-A6CE-B4BA42740803/jgo...@verisign.com>
<mailto:applewebdata://13890C55-AAE8-4BF3-A6CE-B4BA42740803/jgo...@verisign.com>
703-948-3271
12061 Bluemont Way
Reston, VA 20190
Verisign.com<http://verisigninc.com/>
<http://secure-web.cisco.com/1AwKlvS6mjX9gmbKA1esca1gF6gxkHG4Hoq0dLgqeXboqam0LCBCpr8v4YeIi-PL4RHebdkRdmVtjkdl7oEzPIEggNkSHF2MjHGUBV30M8XyMTqLJBjKRIU5jN3-fYZRQliPDXzrDOAhkH4i0BW_HjO9j1PRk_MfBQWzDucjLLtB3U_2AeOEIEBGBQzU6x-Z_zCDwlsvcPJ6eCukHyjxYhuMecKPAfiDTlb04zEM-Zkj10uizRdyIj69BBkvs3XUz/http%3A%2F%2Fverisigninc.com%2F>
On 7/14/21, 3:58 AM, "Mario Loffredo"<mario.loffr...@iit.cnr.it>
<mailto:mario.loffr...@iit.cnr.it> wrote:
Hi all,
Il 12/07/2021 13:26, Gould, James ha scritto:
> Marc,
>
> Thank you for the quick review and feedback. Below are responses to
your early comments:
>
> - would be good to include specific text about jscontact, so when
we switch to it, this document does not need rev.
>
> Agreed, that was thought about while drafting, but we initially left it
out. I'm confident that the extension will work with JSContact, but some text
would help for clarity.
I guess it will work even better than with jCard! JSContact is more
object-oriented than jCard and the json path expressions are simpler since
maps are mostly used to represent collections (e.g.
"$.entities[?(@.roles[0]=='registrant')].jscard.phones.voice.phone"
<mailto:$.entities[?(@.roles[0]=='registrant')].jscard.phones.voice.phone> instead
of"$.entities[?(@.roles[0]=='registrant')].vcardArray[1][?(@[1].type=='voice')]"
<mailto:$.entities[?(@.roles[0]=='registrant')].vcardArray[1][?(@[1].type=='voice')]>)
JG - Yes, JSContact is much easier to express via JSONPath, since there is no
dependency on the use of JSON arrays.
Here in the following a first feedback from my side about the document:
- if, as it seems, the "name" property is unique in the "redacted" array, I would prefer to define
"redacted" as a map where the "name" value is the map key. In theory, every RDAP information can be
redacted but, in practice, the number of RDAP properties usually redacted is limited. If the possible "name"
values were standardized, il would be easier for RDAP clients implementers to check and pick a property inside the
collection of redacted properties.
JG - Agreed, it would be ideal for the "name" property to unique and easy to key off of by the client. The JSONPath expression
provides the technical reference, while the "name" property can represent the logical reference. We didn't want to go down the
IANA registry route in draft-gould-regext-rdap-redacted, but if we add a RDAP JSON Values type for the redaction reason, we could also add
an RDAP JSON Values type of the redaction name. The question would be whether all "name" property values would need to be
registered in the RDAP JSON Values registry. If that is not the case, then we would need change the "name" member to be a JSON
object with the "description" and "type" members used for registered and unregistered values in RFC 9083.
- another possible pre-defined value for "pathLang" might be
"jsonpointer" as an alternative syntax to indentify a value within a JSON doc.
JG - I don't believe JSON Pointer will work for RDAP based on the need for the conditional
expressions (e.g.,"$.entities[?(@.roles[0]=='registrant')]"
<mailto:$.entities[?(@.roles[0]=='registrant')]>). Do you see a way that JSON Pointer
could be used for RDAP? I would only add it if it will work for RDAP.
[ML] - I think it depends on whether the "jsonpath" is meant as a way
to identify a generic RDAP response field or a specific field in the
current RDAP response. Surely, unlike JSONPointer, JSONPath allows to
select a field nested in an array regardless of the position.
Therefore, it is able to represent multiple cases through the same
respresentations. However, an RDAP profile might use conventions (e.g.
the registrant is always the first entity in the array of entities
associated to a domain) making the use of JSONPath filters redundant.
In additon, there are cases where JSONPointer can be used
straightforwardly: for example, a entity lookup response using
JSContact :-) . Anyway, I agree with you that JSONPath fits better
than JSONPointer.
JG – Our initial intention was to use JSONPointer, but it was clear
early on that it would not meet the needs for RDAP responses. My
recommendation is to stick with JSONPath and if someone sees and can
show that JSONPointer is a viable expression language for RDAP
redaction, then we can make it a pre-defined option.
[ML] - Agreed.
- it seems to me that the document assumes that the role used to identify the
redacted entity within the array of entities should be in the first position of
"roles" array. Maybe such assumption should be added somewhere in the
document.
JG - That is the convention, but if there are multiple roles, the server could choose to use a different role value
reference. There is the option for a contact to serve multiple roles ("registrant", "
administrative", "technical", "billing"), but it's unclear whether that is actually used. If
the multi-role contact is redacted by role, then it will add complexity from a redaction perspective, but it can be
done. In the end, I believe this will come down to a implementation consideration item.
[ML] - Generally, an entity is redacted without regard to the role but based on
other conditions: whether the entity represents an individual or not, whether
the entity have expressed the explicit consent for publishing or not. At least
for ccTLDs, it is normal that an entity is both the registrant and the
amministrative contact linked to a domain.
JG – Redaction based on whether the contact is an individual or
provides consent does make sense, but the ICANN draft policy
differentiates the redacted fields based on role. For ccTLDs if a
contact is both the registrant and administrative contact for a
domain, does the RDAP response include a single entity with two roles
instead of including two entities each with a single role? If
redaction is dependent on role, it would be simpler for the server and
the client to return two entities each with a single role and with a
different set of redacted fields.
[ML] - I can speak on behalf of .it. Our RDAP server returns only one
entity with two roles. After all, the protocol has been designed to
consider that and it seems to me an efficient soultion. In my opinion,
it would be more logical and correct that, if the redacted properties
were based on roles and an entity has more roles, the redacted
properties of the entity should be the union of the redacted properties
per each role. Otherwise, there might be a risk to result in a privacy
violation.
Please correct me if I misunderstood the content of section 2.7.4 of
RDAP response profile for gTLDs and I'm giving a wrong example:
if the Organization information MUST be omitted for administrative but
not for registrant entities, if an entity is both registrant and
administrative, the Organization information MUST not be returned anyway.
At least when the same database object is used for different roles, it's
easy to implement that.
- there is a typo in the json path expression of "Registrant Street"
JG - What typo do you see in the JSON Path expression of "Registrant Street". I tested the
"Registrant Street" JSONPath
expression"$.entities[?(@.roles[0]=='registrant')].vcardArray[1][?(@[0]=='adr')][3][:3]"
<mailto:$.entities[?(@.roles[0]=='registrant')].vcardArray[1][?(@[0]=='adr')][3][:3]> against the unredacted
RDAP response, with the result being:
[
"",
"Suite 1235",
"4321 Rue Somewhere"
]
[ML] - Understood. You considered both extended address and post office box as
street components. I have always considered the street information made up only
by the third ADR component beacuse RFC6350 recommends not to use the first two
components to increase interoperability (see below). That being said, I admit
that your JSONPath is able to cover any street representation.
Unlike the use in RFC8977, a JSONPath expression is allowed to select
an array of values in order to communicate that all the values are redacted.
"Experience with vCard 3 has shown that the first two components
(post office box and extended address) are plagued with many
interoperability issues. To ensure maximal interoperability,
their values SHOULD be empty." (RFC6350 section 6.3.1)
JG – I was unsure whether the street would logically match just the
third ADR component of the ADR-value or the first three ADR
components. In the end, I viewed the first three ADR components as
being related to the street address (post office box, the extended
address – apartment or suite number, street address), but if the
street address is only the third ADR component, the example in the
draft can be updated. RFC 9083 does include a reference to the second
ADR component with “Suite 1234”, which is what was also used in
draft-gould-regext-rdap-redacted. If the intent was to redact the
street address, should “Suite 1234” not be also redacted even if RFC
6350 recommends for it to be empty?
[ML] For sure, it should. As I wrote in my previous reply, it is
better to consider also unrecommended cases so the JSONPath selecting
the first three ADR components as street information is preferrable.
[ML] - Another feedback about implementing this extension in search responses.
Provided that this is not the .it case where searches are allowed only to users
legitimated to see the full contact information, I wonder how RDAP servers
permiiting searches more or less publicly might implement it.
Returning the list of all the redacted JSON values included in the
response seems to me inefficient. On the other hand, relying on the JSONPath
capability to select a result set, it would be wrong to use a single generic
JSONPath expression
(e.g.
use"$.domainSearchResults[*].entities[?(@.roles[0]=='registrant')].vcardArray[1][?(@[0]=='email')]"
<mailto:$.domainSearchResults[*].entities[?(@.roles[0]=='registrant')].vcardArray[1][?(@[0]=='email')]>
to communicate that the emails of all domains' registrants are redacted) because, in general,
the same property in different results could be either redacted or unredacted.
Do you think the document should address this topic and how?
JG – The extension is targeted for lookups over searches, since
searches would be too complex. We can add something to the draft to
specify that the extension applies to RDAP lookup responses and not
search responses. Does that make sense to you?
[ML] - Yes, it does.
Best,
Mario
>
> - I really would like to have an IANA registry for the « reason »
property. Because this would be potentially displayed to the user, and
to avoid having all variations of the same reason in different words.
A registry of reserved words would also facilitate translation in
multiple languages.
>
> We had a desire to stay away from needing to setup an IANA registry
for redaction. I view the reason property as not a good candidate for
an IANA registry, since it's meant to be a human readable
informational value that includes normative language not to be used as
a client processing dependency. This is a good discussion item.
>
> Thanks,
>
-- Dr. Mario Loffredo
Technological Unit “Digital Innovation”
Institute of Informatics and Telematics (IIT)
National Research Council (CNR)
via G. Moruzzi 1, I-56124 PISA, Italy
Phone: +39.0503153497
Web:
http://secure-web.cisco.com/1F-PFooJyrWLg51lyW_I49Zvwy3moYXof6OwGqaZON9_0DcwS-s4HC3KttHlW4-GTU-3j7eTkRexCFzAuK9qR5TFk1Va8rwSoh15OdINxFIShnToELNciLpmFWsMNghBtzhTGEfz81tSFv-8jpnVkIF56EAcX0m47l_U0xLdYxjWxvkBykLE6XGyZkw-IHz_8LfdHOV6Ja-dDltW2jsD7CdSMhuy3B4g2ihEL5ekGFFizXUM5jM8rQrdTICQAhGxBqTHe6CwiveYGEUunTsQJxA/http%3A%2F%2Fwww.iit.cnr.it%2Fmario.loffredo
<http://secure-web.cisco.com/1F-PFooJyrWLg51lyW_I49Zvwy3moYXof6OwGqaZON9_0DcwS-s4HC3KttHlW4-GTU-3j7eTkRexCFzAuK9qR5TFk1Va8rwSoh15OdINxFIShnToELNciLpmFWsMNghBtzhTGEfz81tSFv-8jpnVkIF56EAcX0m47l_U0xLdYxjWxvkBykLE6XGyZkw-IHz_8LfdHOV6Ja-dDltW2jsD7CdSMhuy3B4g2ihEL5ekGFFizXUM5jM8rQrdTICQAhGxBqTHe6CwiveYGEUunTsQJxA/http%3A%2F%2Fwww.iit.cnr.it%2Fmario.loffredo>
_______________________________________________
regext mailing list
regext@ietf.org <mailto:regext@ietf.org>
https://www.ietf.org/mailman/listinfo/regext
<https://secure-web.cisco.com/1KSounj1EI0mAuJ5HeObfyLj0PmjQaZ4MvzHpbjQfIsuIUCHOG5lUy9Wi1aoZ2pV114_EkwQv8n5wAGpR5rCOc-aLnkCzWfKDA7jmK1dQuhJIR2PclRd1U7I1LmlUUveLwM9A37iFrBM79cRZfv427hTQRpUNnVB2ZC_DQbFy48OKWRBcJixbykLLbL0AYqxHLzVw36kDRsfVwe-fy80BWMiqXYYjd12-yze4FgAGumlG6YGATEuEFqK7eFyytXPV/https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fregext>
_______________________________________________
regext mailing list
regext@ietf.org
https://www.ietf.org/mailman/listinfo/regext
--
Dr. Mario Loffredo
Technological Unit “Digital Innovation”
Institute of Informatics and Telematics (IIT)
National Research Council (CNR)
via G. Moruzzi 1, I-56124 PISA, Italy
Phone: +39.0503153497
Web: http://www.iit.cnr.it/mario.loffredo
_______________________________________________
regext mailing list
regext@ietf.org
https://www.ietf.org/mailman/listinfo/regext
