[sacm] comments on draft-ietf-sacm-vuln-scenario-01

Jim Schaad <ietf@augustcellars.com> Sat, 20 August 2016 03:23 UTC

From: Jim Schaad <ietf@augustcellars.com>
To: draft-ietf-sacm-vuln-scenario@tools.ietf.org
Date: Fri, 19 Aug 2016 20:23:37 -0700
Message-ID: <000d01d1fa92$3f308a50$bd919ef0$@augustcellars.com>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Thread-Index: AdH5BchGU+WjjgYHR8icVY2ujsZTSQ==
Content-Language: en-us
Archived-At: <https://mailarchive.ietf.org/arch/msg/sacm/JjvnpiodY9X32yjq72W-FIMLpB4>
Cc: sacm@ietf.org
Subject: [sacm] comments on draft-ietf-sacm-vuln-scenario-01
Precedence: list

Section 1 - first sentence.  This says that it is detailed.  I question that
statement as I found it to gloss over almost everything

The second sentence of the introduction makes a promise that I cannot find
fulfilled anyplace in the core text of this document.  How is this informing
protocol or data model development?  What I expect to see if a set of
statements in the document along the lines of "This affects means that we
need to have a protocol that does X" or "This affects the data model because
it needs to do Y."  I expect that this is going to be highlighted in the
text if that is the function of the document.

Section 1 - If prioritization is so important - should it affect the IM?

Section 1 - Are we expecting to publish vulnerabilities in the IM long term?
If so it would see that at least part of publication would be in scope.

Section 2 - are you sure you want me to read this?  Vulnerability
description information:  The subject of the first sentence is Information -
so it appears to say Information which can adversely impact. Kill everything
starting with which

Section 3 - bullet point 1 - How much of the processing is processing into
something that is SACM IM aware?  Actually, looking at most of these
assumptions they seem to be things that people have said that SACM should be
able to do.  It would be useful to call that out and say what things in SACM
will support these assumptions.

Section 3 - bullet point 4 - I have no idea what this says

Section 4.2 - What components are we talking about that it is going to
understood by?  This is the first time that I know that you have used this
word.  As far as I know, there is current no reason for any of this data to
be SACM data but could all be company proprietary.


I found this document to be very hard to review.  From my point of view it
is lacking any useful information and therefore does not help progress any
work in the group.  If it is published I will do my best to forget that it
ever existed and go forward.

Jim

Never ask for a review unless you really want one, you will probably not be
happy with the results.



Appendix I seems to be short on implementation specific details as promised
in section 4.1

B.1 para #1 - The last sentence makes zero sense to me

B.1 para #2-4 - You need to motivate these paragraphs.






Nitpick - most of the time you say "would be handled by" or similar it
should be "is handled by".   Be direct not indirect in what you are stating.

[sacm] comments on draft-ietf-sacm-vuln-scenario-… Jim Schaad