Re: [secdir] secdir review of draft-ietf-mpls-ipv6-only-gap-02

[Tobias Gondrom <[e-mail]>]

Thanks.
Tobias


On 29/10/14 22:45, Carlos Pignataro (cpignata) wrote:
> Tobias,
>
>> On Oct 28, 2014, at 11:46 PM, Tobias Gondrom 
>> <[e-mail] <mailto:[e-mail]>> wrote:
>>
>> Carlos,
>>
>> thanks for your reply.
>> One note inline.
>>
>> On 29/10/14 01:49, Carlos Pignataro (cpignata) wrote:
>>> Tobias,
>>>
>>> Many thanks for your review, and apologies for a delayed response. 
>>> Please see inline.
>>>
>>>> On Oct 22, 2014, at 6:15 PM, Tobias Gondrom 
>>>> <[e-mail] <mailto:[e-mail]>> wrote:
>>>>
>>>>
>>>> I have reviewed this document as part of the security directorate's 
>>>> ongoing effort to review all IETF documents being processed by the 
>>>> IESG.  These comments were written primarily for the benefit of the 
>>>> security area directors. Document editors and WG chairs should 
>>>> treat these comments just like any other last call comments.
>>>>
>>>>
>>>> The draft is informational and identifies and analyses gaps that 
>>>> must be addressed in order to allow MPLS-related protocols and 
>>>> applications to be used with IPv6-only networks.
>>>>
>>>> The document appears ready for publication.
>>> Thanks!
>>>
>>>> The security considerations section (section 8) only states that 
>>>> changing the address family used for MPLS network operation does 
>>>> not fundamentally alter the security considerations of the existing 
>>>> protocol. Which is basically correct. It could have been 
>>>> interesting to look at the gaps analysis from a security 
>>>> perspective and see which of the MPLS IPv6-only gaps has security 
>>>> implications that need to be addressed. I.e. which gaps are 
>>>> security related. However, that is not essential.
>>>>
>>> Ack.
>>>
>>>> Comment:
>>>> 1. Abstract and Section 1:
>>>> the sentence "This document is not intended to highlight a 
>>>> particular vendor's implementation (or lack thereof)" sounds odd. 
>>>> Is there a WG discussion background or why is this document 
>>>> speaking of one "particular vendor's implementation”?
>>> We just wanted to proactively clarify that this gap analysis is one 
>>> on specifications and not in implementations. The important part of 
>>> that sentence is what follows: “, but rather to focus on gaps in the 
>>> standards defining the MPLS suite."
>>
>> I fully understand and saw the following sentence.
>> Just to explain further why I felt the sentence is odd:
>> Actually the wording "a particular" might give a strange impression. 
>> It might just be me being paranoid or overly curious, but if I read a 
>> document explicitly denies something, it makes me curious as to why 
>> it does so and whether there was an according aspect behind it. 
>> Otherwise, why would a document explicitly deny something. ;-)
>> E.g. if the document speaks about "not intended to highlight a 
>> particular vendor's implementation" it gives the feeling as if it 
>> might have started as looking at one particular vendor.
>>
>> If you like to clarify the message as you described in your answer, 
>> you might want to rephrase by removing the "a" before "particular" or 
>> phrase it in a positive way as like ".... is about specifications and 
>> not about particular vendor implementations..."
>>
>> Just a thought.
>>
>
> I agree with you, it’s a good thought. We can turn around in a 
> positive way, and remove the “a”, like this:
>
>       This document is intended to  focus on gaps in
>       the standards defining the MPLS suite, and not to
>       highlight particular vendor implementations (or lack thereof) in the
>       context of IPv6-only MPLS functionality.
>
> Thanks,
>
> Carlos.
>
>> Best, Tobias
>>
>>
>>>
>>>> Nits:
>>>> - section 3.3.1.1. EVPN
>>>> formating: do you want to add one line at the end of the section: 
>>>> "Gap: Minor….
>>>> “
>>>>
>>> Good catch — fixed.
>> Thanks.
>>>
>>>
>>>> I did not find anything else in my review.
>>>>
>>>>
>>>
>>> Thanks!
>>>
>>> Carlos.
>>>
>>>> Thank you and best regards.
>>>>
>>>> Tobias
>