Re: [ippm] Adam Roach's Discuss on draft-ietf-ippm-twamp-yang-11: (with DISCUSS and COMMENT)

[Adam Roach <[e-mail]>]

Thanks for addressing the various comments I made -- your resolutions 
all seem good to me. One comment on the security section, below:

On 6/22/18 2:14 PM, Mahesh Jethanandani wrote:
> ----------------------------------------------------------------------
>> Thanks for the work and thought that everyone involved in this document spent. I
>> find the model well described and easy to understand.
>>
>> I agree with Ben's comments about including more information about the privacy
>> and security properties of specific entities in the module. See
>> https://trac.ietf.org/trac/ops/wiki/yang-security-guidelines for specific
>> guidance.
>>
>> Since this conflicts with normative language in RFC 6087 §3.4 (and 6087bis
>> §3.7), it is a blocking defect that needs to be remedied prior to publication.
> I have added more nodes in the Security Considerations section.

Thanks. This is an improvement, but I'm still a bit concerned about the 
fact that the section speaks only in examples ("examples include" and 
"nodes such as") rather than explicitly identifying sensitive nodes, 
which is what I believe RFC 6087 anticipates. I also don't think that 
simply stating that the attacks that result from changing certain 
parameters "are obvious" is enough to satisfy either the spirit or 
letter of what is intended by:

>     In particular, writable data nodes that could be especially
>     disruptive if abused MUST be explicitly listed by name and the
>     associated security risks MUST be spelled out.
>

/a