Re: [GROW] Alvaro Retana's No Objection on draft-ietf-grow-filtering-threats-07: (with COMMENT)

[Camilo Cardona <[e-mail]>]

Hi Alvaro,

It becomes a security problem when an AS uses any of the techniques to willingly affect another one. However, as Joel mentioned, we removed any type of reference to security, as operators use these almost never for this purpose. At one point, we even removed the security considerations, but we were advised to add it again as a warning to cover that cornercase. 

I understand your point. As this is becoming a loop, I will take the advise of the chairs and the AD of what to do..

Camilo

> On 15 Sep 2015, at 14:24, Alvaro Retana (aretana) <[e-mail]> wrote:
> 
> On 9/15/15, 7:48 AM, "Camilo Cardona" <[e-mail]> wrote:
> 
> Camilo:
> 
> Hi!
> 
>>> ----------------------------------------------------------------------
>>> COMMENT:
>>> ----------------------------------------------------------------------
>>> I have a non-blocking comment related to the characterization of the
>>> unexpected traffic flows (and a nit).
>>> Section 6. (Security Considerations)  Throughout the document the
>>> unexpected traffic flows were characterized as potential policy
>>> violations, not as routing security issues as is done here.  I know that
>>> the text has gone around the point of malicious intent (or not) before,
>>> but I think that if you¹re going to mention that it could be a "potential
>>> routing security issue², then you should say something more about it
>>> (even if it is the result of non-malicious intent) ‹ or just leave it at
>>> policy violations.
>> 
>> <JCC> The security section indeed mentions that the objective of the
>> document is security, however, we stopped focusing on that aspect at an
>> earlier version. We¹ll correct that part to something along the next
>> lines:
>> 
>> OLD: The objective of this document is to inform on this potential
>> routing security issue, and analyze ways for operators to defend against
>> them.
>> NEW: The document informed on the potential routing security issue, and
>> analyzed ways for operators to defend against them.
> 
> That does not solve the point I was trying to make.
> 
> The point is this: this (the sentence above) is the only place in the
> draft where an unexpected traffic flow is characterized as a ³potential
> routing security issue².  If you¹re going to characterize it that way,
> then I think you should explain more: why is is a security issue, what is
> the effect, what can be done to avoid it, etc.
> 
> You mention that the security focus is no more; that¹s in line with what
> Joel wrote (in the thread related to Kathleen¹s comments:
> 
> On 9/1/15, 12:11 PM, "iesg on behalf of joel jaeggli"
> <[e-mail] on behalf of [e-mail]> wrote:
> 
>> We worked pretty hard to keep both the attack terminology out of the
>> document and to keep the focus on the non-malicious action of ordinary
>> actors. I think it's better that we don't lump that in with malicious
>> action of varying varieties.
> 
> I fully agree!  You can make the decision, but if it was me, I would just
> take the sentence out.
> 
> Thanks!
> 
> Alvaro.
>