Re: [sacm] WGLC for draft-ietf-sacm-nea-swima-patnc

All:

The following comments are made as a contributor.

Should we be referencing the NIST interagency report related to SWID or the
ISO standard directly? The NIST document is more readily accessible, and if
they have parity, then we might gain points for referencing the freely
available resource.

Is there a reason to mention TCG + NEA in the introduction? If we're
looking at NEA, then let's just use NEA references and not the TCG ones
for, at least, the sake of consistency.

Propose modified definition for SW-PC: A Posture Collector (PC) that
collects endpoint software inventory information and that conforms to this
specification.

Propose modified definition for SW-PV: A Posture Validator (PV) that
interprets SW Attributes sent by SW-PCs and that conforms to this
specification.

Propose modified definition for SW Attribute: A PA-TNC attribute that
conveys software inventory information. (NOTE: We should ensure that PA-TNC
is the NEA-specific term.)

Propose renaming "SW Attribute" to "SWIMA Attribute", which seems more
accurate. Take a look a the "SW Attribute" subtypes listed in section 5.2
to understand my motivation. Assuming "SW" expands to "software" (which is
a reasonable presumption), then SW Request is not a SW Attribute. A SW
Attribute might be a configuration item that software contains, but not a
SW Request. The SW Request attribute is used to request software inventory
related information from an endpoint, and is thus more appropriately an
attribute associated with SWIMA than with "software". If this is
acceptable, then we should update the term in section 10.1.

Then, we may want to consider expanding "SW" to "SWIMA" wherever
appropriate (i.e. SW Request could become SWIMA Request), which is longer
to type but also inarguably more clear.

On Page 15 the draft states "All SW-PCs MUST at least be able to generate
Software Identifiers for the data model types specified in Section 6 of
this document." Section 6 describes data models for SWID 2009 and SWID
2015, but nothing else. Is this really what we desire? What about Linux
distribution package managers? What about discovered software outside
typical installation patterns? And, does it make sense, in a brokered
architecture like NEA, to require redundant capabilities in the anticipated
myriad collectors?

Are the subscription semantics of this draft intended to be extrapolated to
other types of information collection going over PT-TLS in the future? This
wasn't clear to me when reading the draft, but the IANA table additions
(section 10.2) relating to subscriptions appear to have names generic
enough to be reused. If that's the intent, then maybe we can figure out an
easy way to clarify this in the draft, so that subsequent collection drafts
are easier to create.

Kind regards,

Adam

On Fri, Jul 28, 2017 at 10:41 AM Karen O'Donoghue <odonoghue@isoc.org>
wrote:

> Folks,
>
> This begins a 3 week working group last call (WGLC) for the following
> document:
>
> Software Inventory Message and Attributes (SWIMA) for PA-TNC
> https://datatracker.ietf.org/doc/draft-ietf-sacm-nea-swima-patnc/
>
> We have chosen to do a 3 week WGLC to account for post IETF recovery and
> August vacations.
>
> Please review the referenced document and send any comments to the mailing
> list including your assessment of whether this document is mature enough to
> proceed to the IESG. Please note that these messages of support for
> progression to the mailing list will be used to determine WG consensus to
> proceed.
>
> Please send all comments in by Friday 18 August 2017.
>
> Thank you!
> Karen and Adam
>
> _______________________________________________
> sacm mailing list
> sacm@ietf.org
> https://www.ietf.org/mailman/listinfo/sacm
>