Feedback on mailmaint OAuth Profile for Open Public Clients

Hi all, I owe the working group a review of the "OAuth Profile for Open Public Clients", and apologies for sending this so late after the last IETF meeting, and the night before this IETF meeting. Please note that I have not followed all of the discussion about this draft on the mailing list or recent meetings. If any of my suggestions have already been discussed and decided against, the justification for the decision would be worth noting in the draft for future reference. My feedback is ordered most significant to least significant. Overall, this spec is in good shape. It avoids defining new OAuth mechanisms, it establishes no new relationships between OAuth roles and it uses the standard Resource Owner / Client / AS / RS model. Client Registration My largest piece of feedback is about the use of Dynamic Client Registration. The use of DCR in "open world" OAuth will lead to significant operational burden. I believe I already shared this feedback a couple of years ago. Since then,…