Re: [OSPF] Stephen Farrell's No Objection on draft-ietf-ospf-ttz-05: (with COMMENT)

[Spencer Dawkins at IETF <[e-mail]>]

Make Stephen happy, but ...

On Jan 5, 2017 08:17, "Stephen Farrell" <[e-mail]> wrote:

Stephen Farrell has entered the following ballot position for
draft-ietf-ospf-ttz-05: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)


Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.


The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-ospf-ttz/



----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------


- section 13: I don't agree that there are no new
security considerations, and in fact you seem to raise
one so I'd suggest dropping the "nothing to see here"
pseudo-boilerplate;-)

- section 13: If a router inside a TTZ is borked, then
mechanisms that detect borked routers won't work as
well from outside the TTZ I guess (e.g. they might
identify the wrong router as the borked one). And
contrary-wise, hiding topology may help in that it may
make it harder for an attacker to find a desirable
target. Did anyone think about this? (This is not a
discuss only because I'm not familiar enough with ospf
but I bet a beer that hiding topology will create more
new security issues that are not described here;-)


I think the changes we discussed on my comments to make it clearer what TTZ
looks like to anything outside the TTZ will help, at least a bit, for SEC
types to understand security threats. Maybe it's worth remembering
Stephen's comments when you're adding context early in the document?

Thanks,

Spencer

- 8.1: Did I miss where "Z flag" was described?

- nit: six authors again, plus 2 contributors plus 4
"other authors." I really don't get why it's not
possible to reduce to 5 in cases like this.