Re: [sacm] SACM Architecture Draft

Hi Adam & SACM,

I read the (active) architecture draft, and I believe it's a good one. 
The hackathon work reflected in the draft definitely carries some weight.

Some architecture entities could be expanded and described at a more 
abstract level. For example, this draft appears to equate "capabilities" 
with set of interfaces. Are SACM capabilities supposed to be 
discoverable? If so, how should it be represented? If 
capabilities/functional interfaces are described in more general terms, 
and use XMPP-grid+ as an example of how it meets the functional 
requirements, this may make it appear less solution-centric.

I vote for including workflows in the architecture document. It just 
reads better that way. It will increase the document size and takes 
longer to finish. As long as good progress is being made, is it really 
urgent to finish and publisher the architecture document.

I think the Security Consideration section of the old architecture draft 
is pretty good. Do XMPP-grid XEPs adress the MitM, transport integrity 
and confidentiality concerns mentioned there?

Regards.

- Jarrett

On 12/27/18 01:29 PM, Adam Montville wrote:
> Dear SACM,
>
> Happy (belated) Holidays and a Happy New Year to you!
>
> At our recent virtual interim meeting I promised to post a note to the 
> list regarding our architecture draft to do three things:
>
>  1. Request review
>  2. Indicate whether we (the authors) believe it's on the right track
>  3. Assuming 2 is good, a list of what's left to be done.
>
> So, we're going to start with 2, move on to 3, and then end with 1...
>
> Bill and I both believe that the architecture draft is, indeed, on the 
> right track. Henk, and possibly others (Nancy?), have described this 
> draft as being too solutions-specific. Section 3, "Architectural 
> Overview" is intended to be the place in this draft to describe the 
> abstract ideas in the architecture. Section 3.1 talks a little bit 
> about the roles of the SACM Components, and Section 3.2 provides the 
> known information about an XMPP-based instantiation of the 
> architecture (note Appendix A maps this instantiation back to our SACM 
> requirements, RFC8248).
>
> Assuming that we are on the right track, then here's what we think yet 
> needs to be done:
>
>   * Document specific Components, Capabilities, Interfaces, and Workflows
>       o IT Asset Management could probably stand to be fleshed out
>       o Vulnerability Management is reasonable documented in this
>         draft, but may need work
>       o Configuration management probably needs to be fleshed out as
>         well (needs to be tied to SACM Use Cases)
>   * Determine where to document the above (in this draft or in new
>     drafts), which will determine how long this draft takes to complete.
>   * Prague hackathon to continue the trend of discovering an
>     XMPP-based solution
>   * TODOs in the draft
>       o Privacy Considerations
>       o Security Considerations
>   * Flesh out our IANA Considerations
>       o Will likely result in additional draft work
>
>
>
> Clearly, there's a lot to be done here, and we really need your 
> specific, actionable feedback on this draft. Feel free to reach out 
> here or to either of us directly.
>
> This draft in GitHub: https://github.com/sacmwg/draft-ietf-sacm-arch
>
> This draft on the SACM documents page: 
> https://datatracker.ietf.org/doc/draft-ietf-sacm-arch/
>
>
> Kind regards,
>
> Adam & Bill
>
>
> _______________________________________________
> sacm mailing list
> sacm@ietf.org
> https://www.ietf.org/mailman/listinfo/sacm