Re: [dhcwg] Stephen Farrell's No Objection on draft-ietf-dhc-dhcpv4-active-leasequery-06: (with COMMENT)

[Brian Haberman <[e-mail]>]

All,

On 9/30/15 12:49 PM, Kathleen Moriarty wrote:
> On Wed, Sep 30, 2015 at 12:47 PM, Stephen Farrell
> <[e-mail]> wrote:
>> Stephen Farrell has entered the following ballot position for
>> draft-ietf-dhc-dhcpv4-active-leasequery-06: No Objection
>>
>> When responding, please keep the subject line intact and reply to all
>> email addresses included in the To and CC lines. (Feel free to cut this
>> introductory paragraph, however.)
>>
>>
>> Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
>> for more information about IESG DISCUSS and COMMENT positions.
>>
>>
>> The document, along with other ballot positions, can be found here:
>> https://datatracker.ietf.org/doc/draft-ietf-dhc-dhcpv4-active-leasequery/
>>
>>
>>
>> ----------------------------------------------------------------------
>> COMMENT:
>> ----------------------------------------------------------------------
>>
>>
>> I think I recognise almost all of the security/privacy text we
>> ended up with for the dhcpv6 equivalent - thanks for getting all
>> that right!
>>
>> For Alissa and Ben - I'd be happier too if only secure mode
>> existed here, but there was an argument (which I've forgotten)
>> as to why we needed the insecure one - I think it boiled down to
>> doing it on the same machine or that they'd do it no matter what
>> the RFC says. (But I may be mis-remembering.) So while I agree
>> with your points on that, I'm not sure we're (i.e. we as IESG)
>> right to fight the battle again over this one when they're
>> making this the same as the dhcpv6 one we already approved.
>> Anyway, if you do fight the battle over and win, we should
>> probably ensure any resulting edits also get done to the dhcpv6
>> equivalent spec which is with the RFC editor still.
> 

When the DHCPv6 equivalent draft came to the IESG, one of the authors
responded to Stephen's point on the insecure mode with this:

        We did not consider RFC 7258 as particularly relevant to this
	protocol since we expect that the requestors of this protocol
	will be processing elements that sit next to the DHCP server
	and would have direct access to the DHCP server's database (if
	the DHCP server allowed direct access to its database).

It is pretty clear that the use of this protocol is protected via
physical location and access controls.

Regards,
Brian