Re: [Secdispatch] [Smart] New Version Notification for draft-lazanski-smart-users-internet-00.txt

[Melinda Shore <[e-mail]>]

On 7/14/19 2:56 AM, Eliot Lear wrote:> I think you’re primarily
referring to leaky user databases here.

No, to the entire draft.

> However, to exploit the vulnerability, the
> attack had to come from somewhere.  

I sincerely hope that you're not arguing that anything
that happens on an endpoint is within the scope of the
IETF if that endpoint is network-attached.

> We already have one mechanism to
> address profiling with IoT that manufacturers can use to keep their
> systems from being exploited as BoTs.  

We also had the work done in Network Endpoint Assessment.
Both of these things are on-the-wire protocols and something
that we can do something about.  However, the only things I
saw in the draft that was something that might be within
the IETF's purview is related to software updates, and aside
from SUIT there's work on this going on elsewhere.  Although
if someone wants to make the case for software transparency
logging, please do it soon before trans shuts down).

> Or an RG or a side meeting.  It would be fun to continue the
> discussion.

I'm not sure that's clear.  It's my own opinion that the
charter that's been proposed so far for a research group would
need a massive rewrite and that the folks advocating this work
really don't want to change much to make it more suitable for
chartering as an RG.  If you want to continue as a side
meeting I guess that's your business, but in the meantime opsec
does exist.  It's currently focused on network devices but I
think it may be worth talking with them.

Melinda

-- 
Melinda Shore
[e-mail]

Software longa, hardware brevis