Re: [Idr] Alissa Cooper's No Objection on draft-ietf-idr-as-migration-03: (with COMMENT)

[Alissa Cooper <[e-mail]>]

On Feb 18, 2015, at 1:51 PM, Susan Hares <[e-mail]> wrote:

> Alissa: 
> 
> Could you unpack your concerns a bit more on section 1 and this section?  Why is this not just a pragmatic comment on a reality of business that can happen?  This specification is documenting what exists in real networks with real costs. 
> 
> What causes you to hold your nose?  

Sure. If anything that causes any entity to lose (or gain) revenue can be considered a security issue, we would likely end up doing a lot of strange things in protocol design in the name of “security.” Furthermore, one entity’s loss can often be another’s gain, where neither entity would be considered an attacker in the sense of perpetrating an attack a la RFC 4949. So I think it makes a lot more sense to focus security considerations on technical threats and mitigations and not consider any particular party’s potential loss of revenue in and of itself as a security threat. 

Alissa

> 
> Sue 
> 
> --------
> 
> The text: below: 
> 
> "This could result in a loss of revenue if the ISP is billing based on measured utilization
>   of traffic sent to/from entities attached to its network."
> 
> Considering loss of revenue in and of itself to be a security issue is a slippery slope that we should probably not start to descend. I held my nose for the revenue-related text in Section 1, but here in Section 9 it seems particularly ill-advised.
> ========
> Why is this not just a comment on a reality of business that can happen? What causes you to hold your nose? 
> 
> 
> These  
> 
> -----Original Message-----
> From: Alissa Cooper [mailto:[e-mail]] 
> Sent: Wednesday, February 18, 2015 3:37 PM
> To: The IESG
> Cc: [e-mail]; [e-mail]; [e-mail]; [e-mail]
> Subject: Alissa Cooper's No Objection on draft-ietf-idr-as-migration-03: (with COMMENT)
> 
> Alissa Cooper has entered the following ballot position for
> draft-ietf-idr-as-migration-03: No Objection
> 
> When responding, please keep the subject line intact and reply to all email addresses included in the To and CC lines. (Feel free to cut this introductory paragraph, however.)
> 
> 
> Please refer to http://www.ietf.org/iesg/statement/discuss-criteria.html
> for more information about IESG DISCUSS and COMMENT positions.
> 
> 
> The document, along with other ballot positions, can be found here:
> http://datatracker.ietf.org/doc/draft-ietf-idr-as-migration/
> 
> 
> 
> ----------------------------------------------------------------------
> COMMENT:
> ----------------------------------------------------------------------
> 
> Section 9:
> "This could result in a
>   loss of revenue if the ISP is billing based on measured utilization
>   of traffic sent to/from entities attached to its network."
> 
> Considering loss of revenue in and of itself to be a security issue is a slippery slope that we should probably not start to descend. I held my nose for the revenue-related text in Section 1, but here in Section 9 it seems particularly ill-advised.
> 
> 
>