Re: [secdir] SECDIR review of draft-giralt-schac-ns-04

[Victoriano Giralt <[e-mail]>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: RIPEMD160

On 7/3/11 22:46, Chris Lonvick wrote:
> The only security concern I have is that the registration URN is not yet
> active and that it is limited to HTTPS.  While I think it is still going
> to take some time for this ID to become an RFC, I'd just like to see the
> web site set up sooner rather than later so the kinks may be ironed out.
This has been a long time on the writing queue, but I wanted to iron out
all kinks.

> Beyond that, I think that it would be better to state that it will always
> be a "secure web site" which will offer credentials signed by such-n-such,
> and will require the latest secure methods for accessing a web site; that
> currently being http [reference] with the latest TLS transport
> [reference].  My issue with this is that "https" can still reference SSLv2
> and I don't think that's the intent of the statement in this ID.
> 
> I don't have any concerns about the Security Considerations section other
> than the statement about using "HTTPS" as noted above.
I totally agree with you. SSLv2 is a no-no. I had not properly grasped
the meaning of your comment and started to think about a domain expert
that could help me to address your concerns. With the present
formulation I have fully understood your concern, thanks for
enlightening this old web dinosaur.

> The terms TERENA and TF-EMC2 are used without first defining them.  Maybe
> some changes in Section 1.
Addressed

> I think that the second paragraph of the Abstract could use some
> polishing.
Polished

> CML> I see that this paragraph is been duplicated into the Introduction.
> I don't think that's necessary.
Removed from the intro.

> In Section 4, the word "Anyhow" is ambiguous.  I'd suggest replacing it
> with a more definite word such as "Regardless", or with the term "In any
> case".
You are right. I've gone for "In any case".

> In Section 5, the term "NREN" is not defined before it is used.  I'd
> suggest:
That was changed after other reviewer's comments.

> CML> I see that this version does use the term "National Research and
> Education Network" but it's not associated with the acronym.
I hope the acronym is now associated.

> In the third paragraph of Section 5, remove the term "as soon as
> practical".  ...just get it done.  :-)
Done. It was suffering the "we have a lot of work, will take care of
this once the namespace is granted" syndrome. It is up, though not
running in full swing.

> Could you add a URL to reference [4]?
> 
> CML> Could you also add a URL for reference [5]?
I swear all references have URLs in the XML version, the xml2rf tool
eats those references when doing the transformation. They are not had
inserted again.


> Best regards,
> Chris
Thank you very much, Victoriano.

- -- 
Victoriano Giralt
Systems Manager
Central ICT Services
University of Malaga
SPAIN
- -
A: Yes.
> > Q: Are you sure ?
>> >> A: Because it reverses the logical flow of conversation.
>>> >>> Q: Why is top posting annoying in email ?
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.8 (Darwin)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iD8DBQFN095DV6+mDjj1PTgRAz+NAJ0expp5KF7EWKG8rZNkHlF5fbqizQCfSJx3
wSmQJfxlnqLloKkcImx0AlE=
=sJd/
-----END PGP SIGNATURE-----