Re: [OPSAWG] Éric Vyncke's Yes on draft-ietf-opsawg-sbom-access-15: (with COMMENT)

[Eliot Lear <[e-mail]>]

Thank you Eric, please see below.

On 24.04.23 10:53, Éric Vyncke via Datatracker wrote:
> Éric Vyncke has entered the following ballot position for
> draft-ietf-opsawg-sbom-access-15: Yes
>
> When responding, please keep the subject line intact and reply to all
> email addresses included in the To and CC lines. (Feel free to cut this
> introductory paragraph, however.)
>
>
> Please refer to https://www.ietf.org/about/groups/iesg/statements/handling-ballot-positions/
> for more information about how to handle DISCUSS and COMMENT positions.
>
>
> The document, along with other ballot positions, can be found here:
> https://datatracker.ietf.org/doc/draft-ietf-opsawg-sbom-access/
>
>
>
> ----------------------------------------------------------------------
> COMMENT:
> ----------------------------------------------------------------------
>
> Thank you for the work put into this document.
>
> Please find below some non-blocking COMMENT points (but replies would be
> appreciated even if only for my own education).
>
> Special thanks to Win Wu for the shepherd's detailed write-up including the WG
> consensus and the justification of the intended status.
>
> I hope that this review helps to improve the document,
>
> Regards,
>
> -éric
>
> # COMMENTS (non blocking)
>
> ## 'transparency' vs. 'sbom'
>
> This is probably due to historical reasons, but I find it strange to have the
> YANG module named 'transparency' while this term does not appear in the
> abstract.

It is, and we can add some text clarify this.

>
> ## Abstract
>
> I am not a native English speaker, so I am probably outside of my expertise
> here, but:
>
> * `automation is necessary to locate what software is running` should 'to
> identify' or 'to list' be better ? * `to provide the locations of software
> bills of materials (SBOMS) and to vulnerability information.` is there a verb
> missing between 'to' and 'vulnerability' ? I must admit that I cannot parse
> this sentence.

I will eview the grammar.

> ## Section 1
>
> `we seek` who is the 'we' ?

Fixed.

>
> s/the model is a discovery mechanism/the model can be used as a discovery
> mechanism/ ? I.e., how can a model be a mechanism ?

"the model is intended to facilitate discovery"


>
> In `report to administrators the state of a system.` "state" is rather vague,
> can the state be qualified ? I.e., "security state" ?

"state of any known vulnerabilities on a system"


>
> In the introduction of the 3 methods, the 2nd one (URI) is the only one having
> a normative MUST. Is it on purpose that the two other methods do not have
> normative language ?

Could you be more specific?


>
> ## Section 6
>
> `the endpoint SHOULD NOT provide unrestricted access by default` this is indeed
> a key point as the SBOM can also be viewed as the list of open doors to the
> device. I am really unsure how to fix this problem at all...
>
> I would also wish to have a mean to keep the SBOM information available for
> years even after manufacturer bankruptcy ...

I agree, and yet someone has to pay to keep the disks spinning, as it 
were.  As a matter of pragmatics, this will have to be addressed market 
by market.  There is no reason, for instance, that the model has to 
reside on manufacturing-owned gear, but then where it does reside might 
also go belly up.  Those business models can, I think, be kinked out 
over time.

Eliot