Re: [Mud] what if MUD file is now longer available?

[Michael Richardson <[e-mail]>]

Eliot Lear <[e-mail]> wrote:
    >> Eliot Lear <[e-mail]> wrote:
    >>>> Section 13.2 says that the MUD-manager should cease processing at that point.
    >>>> I guess at that point, the access should therefore be default-deny.
    >>>> I guess the other question is what would the access be if there were no
    >>>> MUD URL at all.  We'd all like to be default-deny, but I think that during
    >>>> a transition period it can't be that.
    >>
    >>
    >>> If you ever had a valid MUD file you should keep using it.  This
    >>> follows the principle of least astonishment.  Otherwise, a temporary
    >>> outage might cause policy flaps.  An alternative might be to invoke an
    >>> exception flow that says, “yo! No more MUD file”.
    >>
    >> Yes, I'm asking: what if the MUD-manager never got a valid MUD file.
    >> It did exist at some point, but then marketing moved it when they redid the
    >> web site, or the company just went under.

    > I think this ties to the draft we discussed putting together in Prague.
    > That is- a search path of sorts.

Yes.  We agreed that it was more than a local decision because there is the
issue of how the signatures will work.  Both where the signature is to be
found, and how the MUD file can be amended with new signatures.

(I know very little about WebDAV's PATCH method.  I see that in rfc4918 there
is PROPPATCH, and it seems to apply to XML content.  I was thinking that
maybe we could borrow from that specifications to describe modifications, and
sign those)

    >>> A few things to think about with this use case.  We really don’t have
    >>> contact information in the MUD file.  While one might think that an
    >>> oversight, honestly I get a little nervous about sticking email
    >>> addresses in various places that can be harvested for SPAM.
    >>
    >> The contact info does not have to be an email address.
    >>
    >> It could point to quite a number of other things.
    >> There are some identities out there like 1id.com, Dun&Bradstreet numbers, RIR
    >> handles,  URLs, …
    >>

    > True- in YANG terms this would be a CHOICE.  Let’s not go crazy with the # of choices, tho.

Fair enough.  Isn't URI probably enough?

--
]               Never tell me the odds!                 | ipv6 mesh networks [
]   Michael Richardson, Sandelman Software Works        |    IoT architect   [
]     [e-mail]  http://www.sandelman.ca/        |   ruby on rails    [


--
Michael Richardson <[e-mail]>, Sandelman Software Works
 -= IPv6 IoT consulting =-