Re: [secdir] sec-dir review of draft-ietf-bliss-call-completion-18

[Robert Sparks <[e-mail]>]

On 12/19/12 3:43 AM, [e-mail] wrote:
> Hi Derek,
>
> thanks for the review.
>
> 'SPIT' is an acronym for 'Spam over Internet Telephony', which Wikipedia defines as 'bulk unsolicited, automatically dialled, pre-recorded phone calls using the Voice over Internet Protocol (VoIP)'. (http://en.wikipedia.org/wiki/VoIP_spam)
>
> We will add a proper definition for SPIT.
Defining the term in place is sufficient. If you decide you need a 
reference, consider RFC5039
("The Session Initiation Protocol (SIP) and Spam").

RjS
>
>
> For the DoD attack: 'DoD' actually does mean 'Department of Defence', the authors of the draft have received information that the Department of Defence plans to attack something, but because of secrecy reasons we cannot give more information at this time.
>
> ;-)
>
> Joking apart, yes, this is a typo of 'DoS' (Denial of Service), a proper definition will be added.
>
>
> Thanks for your support.
>
>
> Regards, Martin
>
>
>
>
>
>> -----Ursprüngliche Nachricht-----
>> Von: Derek Atkins [mailto:[e-mail]]
>> Gesendet: Montag, 17. Dezember 2012 16:55
>> An: [e-mail]; [e-mail]
>> Cc: [e-mail]; [e-mail];
>> Hülsemann, Martin; Jesske, Roland; [e-mail]
>> Betreff: sec-dir review of draft-ietf-bliss-call-completion-18
>>
>> Hi,
>>
>> I have reviewed this document as part of the security
>> directorate's ongoing effort to review all IETF documents
>> being processed by the IESG.  These comments were written
>> primarily for the benefit of the security area directors.
>> Document editors and WG chairs should treat these comments
>> just like any other last call comments.
>>
>>     The call completion feature defined in this specification
>> allows the
>>     caller of a failed call to be notified when the callee becomes
>>     available to receive a call.
>>
>> The Security Considerations section mentions 'SPIT' but
>> nowhere does the document define the term.  What does it mean?
>>
>> The SC section also mentions a "DoD" attack -- is the US
>> Department of Defence actually going to attack something?  Or
>> does DoD mean something else?  It's never defined.  Was this
>> perhaps a typo of "DoS", Denial of Service?  If so, I
>> recommend you fix the typo but also expand the acronym for
>> those not necessarily familiar with the term "DoS".
>>
>> -derek
>>
>> --
>>         Derek Atkins                 617-623-3745
>>         [e-mail]             www.ihtfp.com
>>         Computer and Internet Security Consultant
>>