[mile] Alissa Cooper's Discuss on draft-ietf-mile-rfc5070-bis-22: (with DISCUSS and COMMENT)

["Alissa Cooper" <[e-mail]>]

Alissa Cooper has entered the following ballot position for
draft-ietf-mile-rfc5070-bis-22: Discuss

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)


Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.


The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-mile-rfc5070-bis/



----------------------------------------------------------------------
DISCUSS:
----------------------------------------------------------------------

The Confidence class as defined in 3.12.5 seems underspecified. It does
not specify a max value, so some implementations might use 1 as the max
while others might use 100. 

It's also hard to understand how a single confidence value is supposed to
be applied to elements with multiple fields, as in 3.12 and 3.29. What do
I do if I have high confidence in my estimate of SystemImpact but low
confidence in my estimate of MonetaryImpact?


----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

(1) Section 1: It would be useful to define "cyber," "cyber indicator"
(somewhere before 3.29), "cyber threat," and "cyber event." I chuckled
when I wrote that, but I'm serious. The term "cyber" did not appear in
RFC 5070. It has clearly taken on some (mythical, perhaps) meaning in
venues external to the IETF. I think if this document is going to use the
term, it needs to explain what it means. If there are some external
definitions to point to or adopt, that would be fine.

(2) Section 3.19.2: If I want to list the admin contact for a particular
domain in a Contact element within a DomainContacts element, do I set the
role in the Contact to "admin" or to "zone"? I think this is not entirely
clear from how the roles are specified in 3.9 since most of the roles are
more generic than "zone."