[NNTP] NNTP working group status

[ned.freed at mrochek.com]

> ned.freed at mrochek.com wrote:

> > I agree with this assessment, although I have yet to review the STARTTLS
> > draft to see if it meets all of the newer things the security folks want
> > out of TLS in more recent protocols.

> Ned, do you have a reference to these "newer things" so I can get a jump
> on them?

They came up in the MSGTRK group and ended up in RFC 3887. Basically what was
called for was a parameter on STARTTLS specifying the domain name of the server
the client believes it is talking to. In the words of RFC 3887:

   The parameter MUST be a fully qualified domain name (FQDN).  A client
   MUST specify the hostname it believes it is speaking with so that the
   server may respond with the proper TLS certificate.  This is useful
   for virtual servers that provide message tracking for multiple
   domains (i.e., virtual hosting).

This is really more of a matter for draft-ietf-nntpext-tls-nntp-03.txt,
but as there are some STARTTLS examples in draft-ietf-nntpext-tls-nntp-03.txt
there is some impact there as well.

> > As a purely practical point, if all of them get to the RFC Editor within a
> > reasonably close period of time the RFC Editor is likely to lump them together
> > in terms of the RFC numbers they get. They're smart this way... Although if we
> > got a move on we might even be able to get RFC 3977 as the number for the
> > revised NNTP specification ;-)

> This has already been suggested and I believe Russ was looking into it.

Cool, I must have missed it.

				Ned