Re: [OPSAWG] Éric Vyncke's Yes on draft-ietf-opsawg-sbom-access-15: (with COMMENT)

["Eric Vyncke (evyncke)" <[e-mail]>]

Hello Eliot,

Thanks for the quick reply and the actions proposed in it. 

Some more comments tagged with EV>

Regards

-éric

On 24/04/2023, 11:33, "Eliot Lear" <[e-mail] <mailto:[e-mail]>> wrote:


Thank you Eric, please see below.


On 24.04.23 10:53, Éric Vyncke via Datatracker wrote:
> Éric Vyncke has entered the following ballot position for
> draft-ietf-opsawg-sbom-access-15: Yes
>
> When responding, please keep the subject line intact and reply to all
> email addresses included in the To and CC lines. (Feel free to cut this
> introductory paragraph, however.)
>
>
> Please refer to https://www.ietf.org/about/groups/iesg/statements/handling-ballot-positions/ <https://www.ietf.org/about/groups/iesg/statements/handling-ballot-positions/>
> for more information about how to handle DISCUSS and COMMENT positions.
>
>
> The document, along with other ballot positions, can be found here:
> https://datatracker.ietf.org/doc/draft-ietf-opsawg-sbom-access/ <https://datatracker.ietf.org/doc/draft-ietf-opsawg-sbom-access/>
>
>
>
> ----------------------------------------------------------------------
> COMMENT:
> ----------------------------------------------------------------------
>
> Thank you for the work put into this document.
>
> Please find below some non-blocking COMMENT points (but replies would be
> appreciated even if only for my own education).
>
> Special thanks to Win Wu for the shepherd's detailed write-up including the WG
> consensus and the justification of the intended status.
>
> I hope that this review helps to improve the document,
>
> Regards,
>
> -éric
>
> # COMMENTS (non blocking)
>
> ## 'transparency' vs. 'sbom'
>
> This is probably due to historical reasons, but I find it strange to have the
> YANG module named 'transparency' while this term does not appear in the
> abstract.


It is, and we can add some text clarify this.

EV> this would be nice for the reader.

>
> ## Abstract
>
> I am not a native English speaker, so I am probably outside of my expertise
> here, but:
>
> * `automation is necessary to locate what software is running` should 'to
> identify' or 'to list' be better ? * `to provide the locations of software
> bills of materials (SBOMS) and to vulnerability information.` is there a verb
> missing between 'to' and 'vulnerability' ? I must admit that I cannot parse
> this sentence.


I will eview the grammar.


> ## Section 1
>
> `we seek` who is the 'we' ?


Fixed.


>
> s/the model is a discovery mechanism/the model can be used as a discovery
> mechanism/ ? I.e., how can a model be a mechanism ?


"the model is intended to facilitate discovery"

EV> perfect



>
> In `report to administrators the state of a system.` "state" is rather vague,
> can the state be qualified ? I.e., "security state" ?


"state of any known vulnerabilities on a system"

EV> perfect


>
> In the introduction of the 3 methods, the 2nd one (URI) is the only one having
> a normative MUST. Is it on purpose that the two other methods do not have
> normative language ?


Could you be more specific?

EV> sure, the paragraph below as a "MUST" while the one before and the one after do not. And, they are all describing 3 methods considered by this I-D. I find it unbalanced, not critical of course.

"Using the second method, when a device does not have an appropriate retrieval interface, but one is directly available from the manufacturer, a URI to that information MUST be discovered."



>
> ## Section 6
>
> `the endpoint SHOULD NOT provide unrestricted access by default` this is indeed
> a key point as the SBOM can also be viewed as the list of open doors to the
> device. I am really unsure how to fix this problem at all...
>
> I would also wish to have a mean to keep the SBOM information available for
> years even after manufacturer bankruptcy ...


I agree, and yet someone has to pay to keep the disks spinning, as it 
were. As a matter of pragmatics, this will have to be addressed market 
by market. There is no reason, for instance, that the model has to 
reside on manufacturing-owned gear, but then where it does reside might 
also go belly up. Those business models can, I think, be kinked out 
over time.

EV> I know, unsolvable problem... an engineering dream that is a unicorn

Eliot