Re: [ippm] Kathleen Moriarty's No Objection on draft-ietf-ippm-6man-pdm-option-09: (with COMMENT)

[Spencer Dawkins at IETF <[e-mail]>]

Just on this point ...

On Tue, Apr 11, 2017 at 11:17 AM, Kathleen Moriarty <
[e-mail]> wrote:

> Kathleen Moriarty has entered the following ballot position for
> draft-ietf-ippm-6man-pdm-option-09: No Objection
>
> When responding, please keep the subject line intact and reply to all
> email addresses included in the To and CC lines. (Feel free to cut this
> introductory paragraph, however.)
>
>
> Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
> for more information about IESG DISCUSS and COMMENT positions.
>
>
> The document, along with other ballot positions, can be found here:
> https://datatracker.ietf.org/doc/draft-ietf-ippm-6man-pdm-option/
>
>
>
> ----------------------------------------------------------------------
> COMMENT:
> ----------------------------------------------------------------------
>
> I support Warren's discuss and comments and have a few additional
> comments to add.
>
> Kind of related to Warren's discuss, I kept looking for a limitation to
> the scope for this work in the draft and didn't get to one until the end
> of the security considerations section.  The text there wasn't quite
> clear enough for me.  It seems that this might only be used for small
> periods of time while troubleshooting, is that correct?  It also seems
> like this has to be end-to-end, is that right?  And if it does need to be
> end-to-end, is the user aware of this troubleshooting so that they are
> not sending traffic that contains sensitive data that should remain
> confidential (security or privacy implications may also exist if this is
> not the case).
>
> If the scope were limited, I would not have as many security concerns.
> Network reconnaissance may or may not be an issue.  I don't think it is,
> but I need to better understand the scope of use for this option.
>

I can imagine this comment being balloted almost word for word on the
In-situ OAM work if it doesn't clearly state its own scope, so I'll ask the
IPPM folk to pay close attention to Kathleen's comment in working group
discussions about the scope of In-situ OAM ...

Spencer


> nit:
> s/IPSec/IPsec/g
>
>
>