Re: [ippm] Kathleen Moriarty's No Objection on draft-ietf-ippm-6man-pdm-option-09: (with COMMENT)

[Nalini J Elkins <[e-mail]>]

> Kathleen Moriarty has entered the following ballot position for draft-ietf-ippm-6man-pdm-option-09: No Objection
> Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html for more information about IESG DISCUSS and COMMENT positions.
> The document, along with other ballot positions, can be found here: https://datatracker.ietf.org/doc/draft-ietf-ippm-6man-pdm-option/

>----------------------------------------------------------------------
>COMMENT:
> ----------------------------------------------------------------------

> I support Warren's discuss and comments and have a few additional comments to add.
>Kind of related to Warren's discuss, I kept looking for a limitation to
>the scope for this work in the draft and didn't get to one until the end
>of the security considerations section.  The text there wasn't quite
>clear enough for me.  It seems that this might only be used for small
>periods of time while troubleshooting, is that correct?  It also seems
>like this has to be end-to-end, is that right?  And if it does need to be
>end-to-end, is the user aware of this troubleshooting so that they are
>not sending traffic that contains sensitive data that should remain
>confidential (security or privacy implications may also exist if this is
>not the case).

>If the scope were limited, I would not have as many security concerns. 
>Network reconnaissance may or may not be an issue.  I don't think it is,
>but I need to better understand the scope of use for this option.


We have added wording on the "Consent to be Measured" as a responseto Warren's comments.   Please let me know if that addresses yourconcerns.
In Section 4.4
   An implementation may want to be sure that PDM is enabled only for
   certain ip addresses, or only for some ports.  Additionally, the   implementation SHOULD require an explicit restart of monitoring after   a certain time period (for example for 1 hour), to make sure that PDM   is not accidentally left on after debugging has been done etc. 
   Even so, if using PDM, a user "Consent to be Measured" SHOULD be a   pre-requisite for using PDM.  Consent is common in enterprises and   with some subscription services.  The actual content of "Consent to   be Measured" will differ by site but it SHOULD make clear that the   traffic is being measured for quality of service and to assist in   diagnostics as well as to make clear that there may be potential   risks of certain vulnerabilities if the traffic is captured during a   diagnostic session

 Thanks,

Nalini Elkins
CEO and Founder
Inside Products, Inc.
www.insidethestack.com
[phone]