[Idr] Re: Deb Cooley's No Objection on draft-ietf-idr-link-bandwidth-19: (with COMMENT)

[Jeffrey Haas <[e-mail]>]

On 11/19/25 12:06, Ketan Talaulikar wrote:
> Hi Deb,
>
> I see that the authors have not responded to your comments and so I 
> will attempt to clarify. The authors/WG should feel to respond/clarify.
>
> On Wed, Oct 22, 2025 at 1:15 AM Deb Cooley via Datatracker 
> <[e-mail]> wrote:
>
>     Section 6, para 1:  This specification points to RFC 4360, which
>     points to RFC
>     1997, which says that Security Issues are not discussed. I'm
>     guessing it isn't
>     that part of the RFC 4360 Sec Con section that is being referred? 
>     RFC 4360
>     does also have a short note on the need for a 'transitive trust
>     relationship
>     back to the source of the information' and that the mechanism for that
>     relationship is out of scope. If this concept is still an issue,
>     perhaps it
>     should be in 'Operational Considerations?
>
>
> KT> Looks like RFC4360 skimmed through reviews on this front. If it is 
> any consolation, the IDR WG is working on RFC 4360bis and this comment 
> is better addressed there. I will drop a message to the authors of 
> that draft to point this out. That said, it seems not appropriate for 
> this specific type of Extended Community to take the burden of 
> security considerations applicable to all extended communities in 
> general. Does that work?

Indeed, please let's try to patch core spec deficiencies in this draft.

That said, this is an excellent moment for the IESG to decide what 
security deficiencies are in the core spec and get those added as issues 
to the 4360 bis in github.  We're hoping to move that to IDR working 
group last call soon and this bit of reflection would be helpful.

-- Jeff