[Teas] Roman Danyliw's No Objection on draft-ietf-teas-yang-te-types-10: (with COMMENT)

[Roman Danyliw via Datatracker <[e-mail]>]

Roman Danyliw has entered the following ballot position for
draft-ietf-teas-yang-te-types-10: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)


Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.


The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-teas-yang-te-types/



----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

I concur with Ben Kaduk and Mirja Kühlewind comments about the utility of
additional context for the model.

Section 7.  Other models will import this one, and specific security
considerations will have to be written for them.  Nevertheless, the general
caution provided here could be a bit more specific perhaps on the order of:

-- Per “Write operations (e.g., edit-config) to these data nodes without proper
protection can have a negative effect on network operations”, doesn’t seem to
adequately cover security/privacy issues such as misrouting of traffic for
eavesdropping/inspection, circumventing existing defenses, modification or
replay; and business operation issues such as increased transit bills due to
inappropriate/malicious configuration.

-- Per “The access to such data nodes may be considered sensitive or vulnerable
in some network environments” doesn’t explain the rationale such as that
revealing detailed information about network configuration could exploited in
future attacks.