Re: [Strint-attendees] Fwd: New Version Notification for draft-iab-strint-report-00.txt

["Moriarty, Kathleen" <[e-mail]>]

Thanks for the write up, Stephen & team!

I don't think we covered more recent revelations concerning attacks on administrators to gain access to network equipment.  There may be an RFC already on hardening/security measures, so we may or may not need one.

I'm wondering if 10 could be expanded (or a note added to it that this was released subsequent to the workshop, but is important to capture) to highlight this as a threat vector for pervasive monitoring (iterative compromises leading to access of service provider network equipment to gather data).

Section 5.2 hits on this point (similar enough), but for repositories and not network equipment that could also be used to gather session data, metadata, or logs.

Not sure if it is appropriate or possible to add that in, but thought it was worth raising it.

Thanks,
Kathleen 

Sent from my iPhone

> On May 2, 2014, at 1:46 AM, "Daniel Kahn Gillmor" <[e-mail]> wrote:
> 
>> On 04/29/2014 05:39 AM, Stephen Farrell wrote:
>> 
>> Sorry the link to the draft below was broken, it should
>> be:
>> 
>> [1] https://tools.ietf.org/html/draft-iab-strint-report
> 
> Thanks for doing this writeup, Stephen.  I've only done a brief skim of
> the first half.  I also note you've committed what appear to be
> generated files to the https://github.com/sftcd/strint-report repo in
> addition to the source files.  I think (based on the Makefile) that you
> want edits  to the .xml file, and not the others.
> 
> I recommend removing every generated file from the git repository to
> make the workflow clearer to people who plan to send changes via github.
> 
> I've just pushed a couple minor clarifications and edits to:
> 
> https://github.com/sftcd/strint-report/pull/2
> 
> hth,
> 
>    --dkg
> 
> <signature.asc>
> _______________________________________________
> Strint-attendees mailing list
> [e-mail]
> http://lists.i1b.org/listinfo.cgi/strint-attendees-i1b.org