Sieve Email Filtering: Extension for Notifications
draft-ietf-sieve-notify-12

[Ballot comment]
In response to Cullen's discuss, it is possible to construct parameters
from message content using the Sieve variables extension, as the last
paragraph in the security considerations points out.  That paragraph
points out the need for URL encoding of the parameters, but does not
discuss the security implications of generating the address from
message content.  While I suspect most implementers/users would not be
foolish enough to do that, particularly because the syntax gets so
grotty, it wouldn't hurt to mention how dangerous that is.  One simple
remedy for the threat would be to simply disallow use of sieve variables
in the method parameter of the notify command via script analysis.  Note
that I would not discuss over this issue, but I do think a brief comment
on this issue in the security considerations would improve the document.

My previous comments:

An issue with nomenclature that I recommend fixing.  This document uses
the term "importance" with a completely different meaning from the
"importance" header in the Header Registry.  Indeed, in this document,
the term "importance" has the same meaning as the "priority" header in
the mail headers registry and the "urgency" header in the XMPP registry.
I would prefer this used consistent terminology.  I recommend ":urgency"
or ":priority" instead of ":importance".  I understand the change would
be annoying this late in the process given the notify XMPP document has
to be updated as well, which is why I'm not making this a discuss issue.
But please consider this seriously.

One nit.  The IANA registration template for notification mechanisms
(section 9.2) uses "Standards Track/IESG-approved experimental RFC
number:" in the template, but that registry uses the "Specification
Required" policy that does not require standards track processing
or IESG approval.  I suggest the template use "Permanent and readily
available reference:" to avoid confusion.

[Ballot discuss]
I would like to talk about the security properties of being able to extract the list of users to receive a notification message from the incoming email. The first thing I would like to understand is if this is really needed. Once we get a handle on this, I'd like to figure out how to add some text about security concerns for this. I realize this discuss is crappy but I felt this was better than deferring the document. Basic issues is I want to talk about this, and then decide if any update is needed.

Unless there is some cares where it should not be used, I would like to change "A notification SHOULD include means to identify / track" from a SHOULD to a MUST.

I think the draft should provide a little bit of semantics around the meaning of "online". (As a side note, I think "open" may be a better term than "online"). I can easily be talked out of this if there is a good reason not to.

I believe a tel URL would be more appropriate than the sms URL. This is more a topic for the SMS document.

[Ballot comment]
An issue with nomenclature that I recommend fixing.  This document uses
the term "importance" with a completely different meaning from the
"importance" header in the Header Registry.  Indeed, in this document,
the term "importance" has the same meaning as the "priority" header in
the mail headers registry and the "urgency" header in the XMPP registry.
I would prefer this used consistent terminology.  I recommend ":urgency"
or ":priority" instead of ":importance".  I understand the change would
be annoying this late in the process given the notify XMPP document has
to be updated as well, which is why I'm not making this a discuss issue.
But please consider this seriously.

One nit.  The IANA registration template for notification mechanisms
(section 9.2) uses "Standards Track/IESG-approved experimental RFC
number:" in the template, but that registry uses the "Specification
Required" policy that does not require standards track processing
or IESG approval.  I suggest the template use "Permanent and readily
available reference:" to avoid confusion.

[Ballot comment]
From Gen-ART Review by Pasi Eronen.

  The document effectively creates a new "name space" for
  notification-capability values, and defines a single value
  "online". Shouldn't this be included in the IANA
  considerations section, requesting IANA to maintain a
  registry for notification-capability values?

[Ballot comment]
One nit.  The IANA registration template for notification mechanisms
(section 9.2) uses "Standards Track/IESG-approved experimental RFC
number:" in the template, but that registry uses the "Specification
Required" policy that does not require standards track processing
or IESG approval.  I suggest the template use "Permanent and readily
available reference:" to avoid confusion.

IANA Last Call comments:

Action 1:

Upon approval of this document, the IANA will make the following assignments in the "Sieve Extensions" registry located at
http://www.iana.org/assignments/sieve-extensions

Capability name: enotify
Description: adds the 'notify' action for notifying user about the
received message. It also provides two new test: valid_notify_method
checks notification URIs for validity; notify_method_capability can
check recipients capabilities.
RFC number: [RFC-sieve-notify-10]
Contact address:
The Sieve discussion list


Action 2:

NOTE: Registry has no registration procedures.

Upon approval of this document, the IANA will create the following
registry "Sieve Notification Mechanisms" located at
http://www.iana.org/assignments/TBD
Initial contents of this registry will be:

Registration Template:

To: iana@iana.org
Subject: Registration of new Sieve notification mechanism
Mechanism name: [the name of the mechanism]
Mechanism URI: [the RFC number of the document that defines the URI
used by this mechanism]
Mechanism-specific tags: [the names of any Sieve notify tags that are
specific to this mechanism, or "none"]
Standards Track/IESG-approved experimental RFC number: [the RFC
number of the document that defines this notification mechanism]
Person and email address to contact for further information: [the
name and email address of the technical contact for information about
this mechanism]


We understand the above to be the only IANA Actions for this document.