Netnews Administration System (NAS)
draft-dfncis-netnews-admin-sys-07

The IESG notes the following editorial issues with the draft that should
be addressed prior to publication:

There is no copyright or IPR boilerplate as requested in earlier AD review.

References need to be split into normative and informative groups.

The ABNF rules response-code, Bits, User-ID, Keyblock, Finger, Version,
Key-ID, and Location are referenced but never defined.  These may actually
be technical as well as editorial.

There are also a number of technical issues with this specification:

  The IESG notes that protocol levels, or versions, are used to extend this
  protocol. Version numbers are quite inflexible -- each time additions are
  made to the protocol, a compliant server has to implement all those
  additions plus all previous additions made at lower numbers before it
  can claim to implement the new version. Additionally, version numbers
  don't provide any means of returning per-capability parameters or limits.

  This protocol uses client IP address information for authentication
  purposes. This echoes similar usage in NNTP. While this technique
  has been successful for NNTP in many situations over the years, it
  is not clear it is sufficient going forward. In particular, although
  IP address spoofing attacks are rare, widespread use of dynamic
  address assignment and NAT have reduced both the ability for servers
  to be properly configured with proper client address information as
  well as the ability of an IP address to uniquely identify a single
  client.

  This protocol uses PGP to sign data transferred from one NAS server
  to another. However, it isn't clear that all of the details of
  how to assign and validate PGP keys are sufficiently specified to
  ensure inoperability.

  Finally, various internationalization issues, e.g.
  internationalized newsgroup names, have yet to be addressed in Netnews.
  Although it is clearly inappropriate to deal with Netnews 
  internationalization in this specification, the IESG notes that
  changes may be necessary in this protocol once these issues
  are addressed elsewhere.