Re: [Ntp] Zaheduzzaman Sarker's No Objection on draft-ietf-ntp-port-randomization-06: (with COMMENT)

[Zaheduzzaman Sarker <[e-mail]>]

Hi,

Thanks for addressing my comments. Please see inline below.

BR
Zahed

On 2021-06-04, 08:29, "Fernando Gont" <[e-mail]> wrote:

    Hello, Zaheduzzaman,

    Thanks so much for your comments! -- In-line...

    On 2/6/21 10:13, Zaheduzzaman Sarker via Datatracker wrote:
    [....]
    > I have two observations,
    > 
    >      *   it says "This issue has been tracked by US-CERT with VU#597821, and has
    >      been
    >     assigned CVE-2019-11331." Please provide proper reference to the mentioned
    >     terminologies and assignment.

    Does this look better:

        This issue has been assigned CVE-2019-11331 [VULN-REPORT].


    where:

        [VULN-REPORT]
                   The MITRE Corporation, "CVE-2019-11331", April 2019,
                   <https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-
                   2019-11331>.

    ?


Yes, this is somewhat better. I would suggest following

   This issue has been assigned CVE-2019-11331 [VULN-REPORT], CVE is list of publicly disclosed cybersecurity vulnerabilities which feeds the US National Vulnerability Database (NVD) [NVD].

[NVD] https://nvd.nist.gov/ 



    >      *   removal of section 5: I don't think implementation status is a bad idea
    >      to be included in the memo. If not in a section, may be as appendix.

    Typically, these sections are removed (thereś an RFC on the topic). But 
    I wouldn't mind myself to e.g. keep the Implementation Status in an 
    Appendix.

If there is no one screaming at it then that will be a good idea.

BR
Zahed