Re: [secdir] secdir review of draft-ietf-ospf-ospfv3-mib.txt

[Acee Lindem <[e-mail]>]

Juergen,
I think what I'll ask the authors to do is talk about the risks in  
general terms for read=create and read-only variables. We're NOT  
going have a separate set of security considerations per variable.  
That would be the type of work that was carried out in the now- 
defunct RPSEC WG.
Thanks,
Acee
On Jun 10, 2009, at 12:21 PM, Juergen Schoenwaelder wrote:

> On Wed, Jun 10, 2009 at 05:06:30PM +0200, Acee Lindem wrote:
>> Juergen,
>>
>> You refer to an an attached boiler plate for MIB security
>> considerations but I don't see any attachments.
>
> Sorry, I am trying again to attach the attachment. But this
> boilerplate is really just an extended version of the boilerplate
> posted on the OPS web site. Lines beginning with # are comment
> lines.
>
>> In the future, I'd hope the secdir could register their comments
>> earlier in the process. We have taken this document all the way
>> through the IESG and MIB doctors reviews and are not one day away
>> from the end of the IETF last call.
>
> I understand your feelings. But on the other hand, the requested
> changes do not affect in any way how the MIB module works - it is all
> about properly writing up the security considerations - so this is
> mainly some additional editing work.
>
> /js
>
> -- 
> Juergen Schoenwaelder           Jacobs University Bremen gGmbH
> Phone: [phone]         Campus Ring 1, 28759 Bremen, Germany
> Fax:   [phone]         <http://www.jacobs-university.de/ 
> ><OSPFV3-MIB-boilerplate.txt>