Content-Type: multipart/alternative;
 boundary="------------Y1M0iwqfTzRXLGPuErY8W90n"
Message-ID: <39353f41-b19c-4dea-bde1-a6c278a019c7@pfrc.org>
Date: Wed, 19 Nov 2025 18:02:44 -0500
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
To: Ketan Talaulikar <ketant.ietf@gmail.com>,
 Deb Cooley <debcooley1@gmail.com>
References: 
 <176107589259.922.7123160603901796938@dt-datatracker-675c8fd764-bsflw>
 <CAH6gdPyJ55853-UdL6RuDnHcd4nohMARY6JyeaCehXg_zZnarA@mail.gmail.com>
Content-Language: en-US
From: Jeffrey Haas <jhaas@pfrc.org>
In-Reply-To: 
 <CAH6gdPyJ55853-UdL6RuDnHcd4nohMARY6JyeaCehXg_zZnarA@mail.gmail.com>
Message-ID-Hash: NPFQZ7TRYAO6NSGTGHAA5QOBCU2XNL6G
CC: The IESG <iesg@ietf.org>, draft-ietf-idr-link-bandwidth@ietf.org,
 idr-chairs@ietf.org, idr@ietf.org
Precedence: list
Subject: =?utf-8?q?=5BIdr=5D_Re=3A_Deb_Cooley=27s_No_Objection_on_draft-ietf-idr-link?=
 =?utf-8?q?-bandwidth-19=3A_=28with_COMMENT=29?=
Archived-At: 
 <https://mailarchive.ietf.org/arch/msg/idr/x9J0RdnORjfdjH8L8nocsNqmLTU>

This is a multi-part message in MIME format.
--------------Y1M0iwqfTzRXLGPuErY8W90n
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit


On 11/19/25 12:06, Ketan Talaulikar wrote:
> Hi Deb,
>
> I see that the authors have not responded to your comments and so I 
> will attempt to clarify. The authors/WG should feel to respond/clarify.
>
> On Wed, Oct 22, 2025 at 1:15 AM Deb Cooley via Datatracker 
> <noreply@ietf.org> wrote:
>
>     Section 6, para 1:  This specification points to RFC 4360, which
>     points to RFC
>     1997, which says that Security Issues are not discussed. I'm
>     guessing it isn't
>     that part of the RFC 4360 Sec Con section that is being referred? 
>     RFC 4360
>     does also have a short note on the need for a 'transitive trust
>     relationship
>     back to the source of the information' and that the mechanism for that
>     relationship is out of scope. If this concept is still an issue,
>     perhaps it
>     should be in 'Operational Considerations?
>
>
> KT> Looks like RFC4360 skimmed through reviews on this front. If it is 
> any consolation, the IDR WG is working on RFC 4360bis and this comment 
> is better addressed there. I will drop a message to the authors of 
> that draft to point this out. That said, it seems not appropriate for 
> this specific type of Extended Community to take the burden of 
> security considerations applicable to all extended communities in 
> general. Does that work?

Indeed, please let's try to patch core spec deficiencies in this draft.

That said, this is an excellent moment for the IESG to decide what 
security deficiencies are in the core spec and get those added as issues 
to the 4360 bis in github.  We're hoping to move that to IDR working 
group last call soon and this bit of reflection would be helpful.

-- Jeff


--------------Y1M0iwqfTzRXLGPuErY8W90n
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 8bit

<!DOCTYPE html>
<html>
  <head>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
  </head>
  <body>
    <p><br>
    </p>
    <div class="moz-cite-prefix">On 11/19/25 12:06, Ketan Talaulikar
      wrote:<br>
    </div>
    <blockquote type="cite"
cite="mid:CAH6gdPyJ55853-UdL6RuDnHcd4nohMARY6JyeaCehXg_zZnarA@mail.gmail.com">
      <meta http-equiv="content-type" content="text/html; charset=UTF-8">
      <div dir="ltr">
        <div dir="ltr">Hi Deb,
          <div><br>
          </div>
          <div>I see that the authors have not responded to your
            comments and so I will attempt to clarify. The authors/WG
            should feel to respond/clarify.</div>
          <br>
        </div>
        <div class="gmail_quote gmail_quote_container">
          <div dir="ltr" class="gmail_attr">On Wed, Oct 22, 2025 at
            1:15 AM Deb Cooley via Datatracker &lt;<a
              href="mailto:noreply@ietf.org" moz-do-not-send="true"
              class="moz-txt-link-freetext">noreply@ietf.org</a>&gt;
            wrote:<br>
          </div>
          <blockquote class="gmail_quote"
style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Section
            6, para 1:  This specification points to RFC 4360, which
            points to RFC<br>
            1997, which says that Security Issues are not discussed. I'm
            guessing it isn't<br>
            that part of the RFC 4360 Sec Con section that is being
            referred?  RFC 4360<br>
            does also have a short note on the need for a 'transitive
            trust relationship<br>
            back to the source of the information' and that the
            mechanism for that<br>
            relationship is out of scope. If this concept is still an
            issue, perhaps it<br>
            should be in 'Operational Considerations?<br>
          </blockquote>
          <div><br>
          </div>
          <div>KT&gt; Looks like RFC4360 skimmed through reviews on this
            front. If it is any consolation, the IDR WG is working on
            RFC 4360bis and this comment is better addressed there. I
            will drop a message to the authors of that draft to point
            this out. That said, it seems not appropriate for this
            specific type of Extended Community to take the burden of
            security considerations applicable to all extended
            communities in general. Does that work?</div>
        </div>
      </div>
    </blockquote>
    <p>Indeed, please let's try to patch core spec deficiencies in this
      draft.</p>
    <p>That said, this is an excellent moment for the IESG to decide
      what security deficiencies are in the core spec and get those
      added as issues to the 4360 bis in github.  We're hoping to move
      that to IDR working group last call soon and this bit of
      reflection would be helpful.</p>
    <p>-- Jeff</p>
    <br>
  </body>
</html>

--------------Y1M0iwqfTzRXLGPuErY8W90n--