Re: [secdir] Secdir review of draft-ietf-nfsv4-rfc3530bis-dot-x-16

[Magnus Nyström <[e-mail]>]

Hi Tom, lest there be any misunderstanding: What I suggested was, that it
may make sense to discuss how internationalization aspects as they pertain
to the XDR itself may impact security in this document's security
consideration section. If the main 2530bis document already discusses
internationalization aspects covering also XDR aspects then I don't see a
strong need to add it to this one.
Thanks,
/M


On Tue, Apr 16, 2013 at 5:16 PM, Haynes, Tom <[e-mail]> wrote:

>
>  On Apr 14, 2013, at 11:22 PM, Magnus Nyström <[e-mail]> wrote:
>
>  I have reviewed this document as part of the security directorate's
> ongoing effort to review all IETF documents being processed by the IESG.
>  These comments were written primarily for the benefit of the security area
> directors. Document editors and WG chairs should treat these comments just
> like any other last call comments.
>
> This NFSv4.0 document provides the XDR definition for NFSv4.0. As such,
> except for the introductory section and standard sections towards the end,
> it consists entirely of extractable, machine-readable declarations and
> definitions.
>
> The Security Considerations section simply refers to the rfc2530bis main
> document. This may be sufficient; however, if the NFSv4.0 XDR definition
> introduces any new parsing risks (for example, anything related to
> internationalization?), then it may be better placed in this document.
>  -- Magnus
>
>
>
>  Hi Magnus,
>
>  That simply becomes too unwieldily.
>
>  We have another example of this, RFC 5661 and 5662. I always look at RFC
> 5661 and I rarely look at RFC 5662.
>
>  My expectation is that this is the way others work.
>
>  I would prefer to leave the internationalization work back in the main
> document.
>
>  Thanks,
> Tom
>



-- 
-- Magnus