Re: [sacm] Call for adoption of draft-coffin-sacm-nea-swid-patnc as a SACM WG document

Gunnar Engelbach <gunnar.engelbach@threatguard.com> Wed, 18 May 2016 18:27 UTC

Return-Path: <gunnar.engelbach@threatguard.com>
X-Original-To: sacm@ietfa.amsl.com
Delivered-To: sacm@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8A5AE12D62F for <sacm@ietfa.amsl.com>; Wed, 18 May 2016 11:27:35 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.6
X-Spam-Level:
X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=threatguard-com.20150623.gappssmtp.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JsqMzaOK0Fkt for <sacm@ietfa.amsl.com>; Wed, 18 May 2016 11:27:33 -0700 (PDT)
Received: from mail-pf0-x235.google.com (mail-pf0-x235.google.com [IPv6:2607:f8b0:400e:c00::235]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9DD4012D62C for <sacm@ietf.org>; Wed, 18 May 2016 11:27:33 -0700 (PDT)
Received: by mail-pf0-x235.google.com with SMTP id 206so21206995pfu.0 for <sacm@ietf.org>; Wed, 18 May 2016 11:27:33 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=threatguard-com.20150623.gappssmtp.com; s=20150623; h=from:subject:to:references:cc:message-id:date:user-agent :mime-version:in-reply-to; bh=A90T1GzSdrCDUj1fmE/q9i9lEBQ7Q+TrJ2FWOQk3ws4=; b=bkzqnGjl4cjc4gzL7j6f5wVJLI1kHdywcFLP97/LBjf5/uwoxQ829tyYCmxMGvz5s2 hKYUAeojKXXqNtl36KM6kKbOd6QFrarM3G4/Z/zKGFZT0HskaJ3Wu4RcXgjd/sBuMz0j t9RQsxZW7g8ncYJxdGORlaBqX5EcaOcqn6y7L/S6g+3j28xQkK9YhGUeOVNDiPD4j+4I SvYpJw4/cmd7PhtUlqq9mZmtlTUPsp1XpLjm/DVieM+COuVOta5KK29rAort1Vby8kI0 QYA7MEUmeLJ5Zf88PVoDGmqvRyfALTl67MtHfyo26YkFWYFm5ooqWf1mNBHtS8F47zx5 ylOA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:subject:to:references:cc:message-id:date :user-agent:mime-version:in-reply-to; bh=A90T1GzSdrCDUj1fmE/q9i9lEBQ7Q+TrJ2FWOQk3ws4=; b=lXPXDqAfqHECqrn5bGbjogItqgMG5S6qLcKCe8w6YzDBLoPM0uu/ty0PIvI+/D7Al8 7EAhQo5BiPC7qy/tGz3mq8D4aV9//y/CFmN9+1fUO79bOzATSUz3twrGv7MWbHLaquH8 HTFXv5+yEGtO8IZnCP3nCGJu1u9K1cepkX4si8qlVASctwCIsMvrNut5Y7C0KvCf1LEQ UZgvJQyt+YldlZWyGnYwciToPUrmPA04D1SxHlfRf2rzdRuWKKwUuWHFSWFebxXmqET+ FXNW8z/m9jMzvH2y2L5Iny87GWphrdM+VIMIkfeLfqlZ6OINeYGDF+PcCOX2zHx00bHC z9JA==
X-Gm-Message-State: AOPr4FXv/AoLphk/hCuG60ikXiE0YvCDisi4nKzhn/0/c9za6KYGMzyGneHoY4o0yDjKgA==
X-Received: by 10.98.52.195 with SMTP id b186mr12960158pfa.9.1463596053204; Wed, 18 May 2016 11:27:33 -0700 (PDT)
Received: from [172.16.1.122] (75-142-12-171.dhcp.mdfd.or.charter.com. [75.142.12.171]) by smtp.gmail.com with ESMTPSA id xn3sm13923627pab.32.2016.05.18.11.27.31 (version=TLSv1/SSLv3 cipher=OTHER); Wed, 18 May 2016 11:27:32 -0700 (PDT)
From: Gunnar Engelbach <gunnar.engelbach@threatguard.com>
X-Google-Original-From: Gunnar Engelbach <Gunnar.Engelbach@ThreatGuard.com>
To: tony@yaanatech.com, "Schmidt, Charles M." <cmschmidt@mitre.org>, Michael Godsey <mgodsey@microsoft.com>, Jerome Athias <athiasjerome@gmail.com>
References: <17198AFF-DF5A-46BC-B84A-2AAF1717BD90@isoc.org> <e8798c66-2ac8-7b24-4ab3-d28b4868c94a@yaanatech.com> <BN1PR03MB1231A9F5A4EE487623E5C82AF490@BN1PR03MB123.namprd03.prod.outlook.com> <0aa7684f-5a47-c00a-4b5b-e19484dd718a@yaanatech.com> <CAA=AuEfepDpmQF7TOLe2nvkgEPU9LD49Fc8bSvUCW+F_6yYy5A@mail.gmail.com> <BN1PR03MB1236FEF6EE3127323F9294AAF490@BN1PR03MB123.namprd03.prod.outlook.com> <SN1PR09MB0990AD2634A81C9A7128D120AB490@SN1PR09MB0990.namprd09.prod.outlook.com> <0418b8dc-9fd8-f8d2-3461-ce8e019fe22a@yaanatech.com>
Message-ID: <8eb2719e-6baa-013a-daf5-5f2b269a75c1@ThreatGuard.com>
Date: Wed, 18 May 2016 11:27:34 -0700
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.1.0
MIME-Version: 1.0
In-Reply-To: <0418b8dc-9fd8-f8d2-3461-ce8e019fe22a@yaanatech.com>
Content-Type: multipart/alternative; boundary="------------6B95D2CBE63D30A2BF15BA68"
Archived-At: <http://mailarchive.ietf.org/arch/msg/sacm/5O0pbcD78yKGp2bljbqJ4slhoMU>
Cc: "sacm@ietf.org" <sacm@ietf.org>, Karen O'Donoghue <odonoghue@isoc.org>
Subject: Re: [sacm] Call for adoption of draft-coffin-sacm-nea-swid-patnc as a SACM WG document
X-BeenThere: sacm@ietf.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: SACM WG mail list <sacm.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/sacm>, <mailto:sacm-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/sacm/>
List-Post: <mailto:sacm@ietf.org>
List-Help: <mailto:sacm-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/sacm>, <mailto:sacm-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 18 May 2016 18:27:35 -0000


On 5/18/2016 11:16 AM, Tony Rutkowski wrote:
> Hi Charles,
>
> Thanks.  Useful to have this information.  On
> checking the presentation, this topic is indeed
> treated on the Issue 2 slide.  What is somewhat
> disconnected, however, is that although the
> slide says there is support for both, only 2009
> presently appears.  There is also a strong case
> made for dropping both, as well as describing
> the 2009 tags as a small minority in the near
> future.  Is there any actual data here?
>
> Cudos to whoever put together the slides.
> Nicely done.  Any answer to the JSON question?
>
> Two questions not asked: who might do the
> work to bridge the gap with the gazillion other
> software identifier approaches out there, and
> whether some form of out-of-band SWID capability
> (as is used with may of the other SWID mechanisms)
> cannot be included.  For a lot of IoT stuff, it is
> essential.

This right here is an excellent point.  There are other software ID 
mechanisms out there and SWID is not going to cover everything for which 
there is an alternative.

Because this proposal is so SWID-specific, I can't get behind it. 
However, if it was genericized to allow for use of current and possible 
future tagging mechanisms, I could certainly support that.


--gun


>
> --tony
>
>
> On 2016-05-18 1:38 PM, Schmidt, Charles M. wrote:
>> Hi all,
>>
>> To answer Tony's original question: "Why are we supporting the 2009 version of SWID tags given its known flaws?" - The question of whether to retain support for the 2009 SWID specification was raised at IETF 95 and, within that room, the consensus was to support both versions. The reason was that there are existing 2009 SWID tags deployed today and there was a desire to allow them to be delivered by SWID M&A. If SWID M&A only supported the 2015 SWID version, those older version tags are effectively lost to SACM assessment. Between this and the fact that the same design supports both versions of SWID tags (albeit using a slightly different procedure, which will be better clarified in the next revision), it seemed like there was little point in explicitly excluding collection and delivery of any 2009 tags that might exist.
>
>
>
> _______________________________________________
> sacm mailing list
> sacm@ietf.org
> https://www.ietf.org/mailman/listinfo/sacm