Re: [lisp] Stephen Farrell's No Objection on draft-ietf-lisp-threats-14: (with COMMENT)

[Luigi Iannone <[e-mail]>]

Hi Stephen,

I am fine with the text you are proposing.
Doing additional risk analysis was obvious for me, but it does not harm to spell it out. ;-)

I will include your text thanks a lot.

ciao

L.


> On 22 Jan 2016, at 13:28, Stephen Farrell <[e-mail]> wrote:
> 
> 
> Hi Luigi,
> 
> Just on this bit, the rest is fine...
> 
> On 22/01/16 12:15, Luigi Iannone wrote:
>> What about the following:
>> 
>> 
>> 	Attackers can be classified according to the following four modes of
>>  	operation, i.e., the temporal and spacial diversity of the attacker.
>> 	These modes are not mutually exclusive, they can be used by 
>> 	attackers in any combination, and other modes may be discovered 
>> 	in the future.
> 
> There is a tendency for folks who read documents like this
> that set out N kinds of attack(er) to never consider that
> there may be an N+1th kind of attack(er). It's that that
> I'm suggesting we make clear.
> 
> So I'd go more for:
> 
> "
> In this document we have classified attackers according to
> their modes of operation, i.e., the temporal and spacial
> diversity of the attacker. These modes are not mutually
> exclusive, they can be used by attackers in any combination,
> and other modes may be discovered in the future. And of
> course attackers are not at all bound by our classification
> scheme, so implementers and those deploying will always need
> to do additional risk analysis for themselves.
> "
> 
> But again, that's just a suggestion, feel free to take it
> or leave it.
> 
> Cheers,
> S.