Re: [sacm] XMPP grid

Thanks for the review, Kathleen. 

Do the authors of this I-D plan to present the changes in the latest version at the Monday meeting? I would assume 'yes' but I did not receive any agenda request, and right now the protocols agenda item is TBD. 

Regards,

Dan

> -----Original Message-----
> From: sacm [mailto:sacm-bounces@ietf.org] On Behalf Of Kathleen Moriarty
> Sent: Friday, November 07, 2014 3:40 PM
> To: sacm@ietf.org
> Subject: [sacm] XMPP grid
> 
> Hello,
> 
> I just reviewed the recent version of XMPP grid:
> https://tools.ietf.org/html/draft-salowey-sacm-xmpp-grid-01
> 
> First, thank you for your work on this draft.  It looks very good and I
> appreciate the detailed security considerations section.
> 
> Here are some comments to consider:
> 
> Figure 1 what does dev mean? I didn't see this expanded anywhere, maybe I
> missed it?
> 
> 3.6 2nd bullet, typo NThe
> 
> 6.3.1 set minimum for TLS - 1.2 unless there are reasons why that's not
> possible.
> 
> A reference to the UTA best practices draft for TLS would be good to add in
> this section.  It covers all the decisions admins need to consider (developers
> too).  It's close to finishing up, so it will be published before this draft.
> http://tools.ietf.org/html/draft-ietf-uta-tls-bcp-05
> 
> Http auth has a few newish options for authentication instead of just basic
> and digest, could one of them be an option?  HOBA is about to go into IETF
> last call.
> 6.2.1 - do you want to add a reference to the PM RFC7258?
> 
> 7 privacy section
> It's worth mentioning that the easiest way to protect privacy sensitive data is
> to leave it out in the first place.
> 
> You should add something to cover considerations for End to end crypto. This
> may matter more for any sensitive data that is sent via an alternate protocol
> like if-map.  I'm not as familiar with that protocol as it's been a while since I've
> read the spec.
> 
> For XMPP grid, I think from the flow diagrams, you actually wind up with
> point-to-point data access with no interchanges leveraging the grid until you
> switch to an end-to-end mechanism to transport the structured or
> unstructured data, is that correct?  I just want to make sure that is the case, if
> not, a recommendation for object-level encryption should be added for the
> control plane (common concern in the incident response space, which this
> could be used for as well and SACM has similar considerations for some of
> the data to be transported).
> 
> The draft looks great, thanks.
> 
> Thank you,
> Kathleen
> 
> 
> 
> Sent from my iPhone
> _______________________________________________
> sacm mailing list
> sacm@ietf.org
> https://www.ietf.org/mailman/listinfo/sacm