Re: [secdir] secdir review of draft-ietf-netmod-yang-usage-07

[Andy Bierman <[e-mail]>]

On 07/08/2010 09:38 AM, Tom Yu wrote:
> This document provides usage guidelines for the YANG data modeling
> language so that standards track YANG data models will be more
> readable and interoperable.
>
> The Security Considerations section of this document states that it
> does not introduce any new or increased risks to the management
> system.  In fact, the document includes advice for consistently
> communicating those risks in the context of YANG modules.
>
> The Security Considerations section makes reference to a URL
>
>     http://www.ops.ietf.org/yang-security-considerations.txt
>
>   

oops; not sure why the URL in the draft is wrong.
Here is the correct URL:

http://www.ops.ietf.org/netconf/yang-security-considerations.txt

> which had no content when I last visited it, so I was unable to review
> it.
>
> Section 3.4 lists the items whose security risks must be documented in
> a conforming specification.  It omits the requirement, stated in Section
> 4.13, that potentially harmful operations must be mentioned in the
> Security Considerations section of the conforming specification.
> Section 3.4 should probably include the requirement from 4.13.
>
>   

OK -- good catch

> Editorial:
>
> Is the use of "<CODE BEGINS>" in the example in Section 3.1 adequately
> protected from tools that might interpret that string as beginning a
> code component that is never completed?
>   

good point -- I will add a <CODE ENDS> so a tool will not get fooled.
The usage within single quotes should be OK.


Andy