[Suit] Robert Wilton's No Objection on draft-ietf-suit-information-model-08: (with COMMENT)

[Robert Wilton via Datatracker <[e-mail]>]

Robert Wilton has entered the following ballot position for
draft-ietf-suit-information-model-08: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)


Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.


The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-suit-information-model/



----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Thank for your work on this document.

Generally I found this document to fairly easy to read, although it did feel
somewhat back to front, although this is probably just personal style.  I.e., I
think that I would have preferred for the security considerations section to
describe the threat model and threats, but for all the requirements and user
stories to be documented early in the document before the manifest elements are
described.

Other than the document structure, I also have a question regarding Vendor ID
and Class ID.  Both of these use UUIDs, but it wasn't really clear to me why
UUIDs are better than using a domain and a string.  I appreciate that the
stated goal is that these don't need to be human readable, but does this mean
that it is only the device and device owner who is able to determine whether a
particular firmware is compatible with a particular device.  Is it not
potentially helpful to provide a hint to the user as to whether the firmware
described by a manifest might be suitable for a given device, or is that
information available in some other way?

Regards,
Rob