[Idr] Re: Deb Cooley's No Objection on draft-ietf-idr-link-bandwidth-19: (with COMMENT)

[Deb Cooley <[e-mail]>]

Those responses are fine.

RFC4360bis:  I took a 30 second peek at it, and the current Sec Con are
possibly a cut/paste from RFC4360.  We can ask for an early secdir* review
at any time (now is fine).  The chairs, authors, Ketan or I can make that
request.  Let me know if you want me to do that.

The one thing I would recommend changing is the first sentence (since there
are no Sec Con in RFC 1997).  [so many opportunities here 'that was so
1997']

*recognizing that secdir reviewers have varying expertise, but we can ask
for a change, or ask for a particular reviewer (if there is one who has
done a good job in the past).  It is a manageable situation.

Deb

On Wed, Nov 19, 2025 at 6:02 PM Jeffrey Haas <[e-mail]> wrote:

>
> On 11/19/25 12:06, Ketan Talaulikar wrote:
>
> Hi Deb,
>
> I see that the authors have not responded to your comments and so I will
> attempt to clarify. The authors/WG should feel to respond/clarify.
>
> On Wed, Oct 22, 2025 at 1:15 AM Deb Cooley via Datatracker <
> [e-mail]> wrote:
>
>> Section 6, para 1:  This specification points to RFC 4360, which points
>> to RFC
>> 1997, which says that Security Issues are not discussed. I'm guessing it
>> isn't
>> that part of the RFC 4360 Sec Con section that is being referred?  RFC
>> 4360
>> does also have a short note on the need for a 'transitive trust
>> relationship
>> back to the source of the information' and that the mechanism for that
>> relationship is out of scope. If this concept is still an issue, perhaps
>> it
>> should be in 'Operational Considerations?
>>
>
> KT> Looks like RFC4360 skimmed through reviews on this front. If it is any
> consolation, the IDR WG is working on RFC 4360bis and this comment is
> better addressed there. I will drop a message to the authors of that draft
> to point this out. That said, it seems not appropriate for this specific
> type of Extended Community to take the burden of security considerations
> applicable to all extended communities in general. Does that work?
>
> Indeed, please let's try to patch core spec deficiencies in this draft.
>
> That said, this is an excellent moment for the IESG to decide what
> security deficiencies are in the core spec and get those added as issues to
> the 4360 bis in github.  We're hoping to move that to IDR working group
> last call soon and this bit of reflection would be helpful.
>
> -- Jeff
>
>