Post-facto reporting of media type security considerations

[ned.freed at mrochek.com]

> On Wed October 20 2004 00:02, ned.freed at mrochek.com wrote:

> > > 2. Media types can be registered via a textual form alone, or in an RFC.
> > >     It seems unlikely that IANA can attach comments to an RFC, as RFCs
> > >     are supposed to remain unchanged once published.  There is a
> > >     somewhat obscure errata page, but that's managed by the RFC
> > >     Editor, not IANA.  I therefore believe that the RFC 2048 procedure
> > >    as written is not entirely adequate. Comments?
> >
> > I disagree. The process for revising an RFC is to issue a revised RFC. I see no
> > reason to create yet another process to put this information elsewhere.

> I'm not suggesting putting the information elsewhere; merely that
> IANA may lack the ability to issue a revised RFC (e.g. if the author
> is unable or unwilling to make a revision).

The IANA is no more capable or incapable than anyone else to write an RFC
commenting on something. Whether or not such an RFC would get published is
another matter, of course - such documents have been published in the past, but
the practice of writing "commentary" RFCs has become less common in recent
years, perhaps because the initial vetting and approval process has been
improved to the point where it isn't nearly as useful to create such things.

Again, since the comments mechanism has never been used, whereas the ability to
revise registrations has been used on quite a few occasions, I think this is a
case of worrying about a purely hypothetical problem that seems unlikely to
become real. We have a backlog of pernicious problems causing us considerable
grief that need to be solved; I simply cannot see the point in spending time on
this.

I'd feel differently if the comments mechanism had been used and found to be
lacking in some way. But it (vacuously) hasn't.

				Ned