Re: [NGO] comments on CANMOD BoF

Phil Shafer wrote:
> Andy Bierman writes:
>> Ignoring access control
>> completely is not something the IESG should allow in the charter.
> 
> On access control, we have zero realistic proposals on the table.
> Please feel free to propose something and hopefully you'll see the
> same sort of responding proposals as we saw with YANG and we can
> get a concensus built there.  But this is an effort that can and
> should be separated from the modeling work.
> 

There have been several proposals made to the WG.
All of them have been ignored by the WG.
IMO, they were all realistic proposals.

It is clear the NETCONF WG wants to ignore security,
just like RMONMIB and IPFIX wanted to ignore congestion
and run over UDP.

Standard configuration management based on NETCONF requires more
than a DML.  The NETMOD WG (if there ever is one) should deal
with the entire problem of standardized CM, which includes
secure operation in a multi-user environment.

If the WG agrees that granular access control is pointless and the
standard access control model for NETCONF should be
"root access or nothing", then that should be written
down in a standard.  I hope the IESG rejects it though,
and forces NETCONF to consider security more carefully.

> Thanks,
>  Phil
> 
> 
> 

Andy

_______________________________________________
NGO mailing list
NGO@ietf.org
https://www.ietf.org/mailman/listinfo/ngo