On 9/15/15, 7:48 AM, "Camilo Cardona" <[email protected]> wrote:
Camilo: Hi! >>---------------------------------------------------------------------- >>COMMENT: >>---------------------------------------------------------------------- >>I have a non-blocking comment related to the characterization of the >>unexpected traffic flows (and a nit). >>Section 6. (Security Considerations) Throughout the document the >>unexpected traffic flows were characterized as potential policy >>violations, not as routing security issues as is done here. I know that >>the text has gone around the point of malicious intent (or not) before, >>but I think that if you¹re going to mention that it could be a "potential >>routing security issue², then you should say something more about it >>(even if it is the result of non-malicious intent) ‹ or just leave it at >>policy violations. > ><JCC> The security section indeed mentions that the objective of the >document is security, however, we stopped focusing on that aspect at an >earlier version. We¹ll correct that part to something along the next >lines: > >OLD: The objective of this document is to inform on this potential >routing security issue, and analyze ways for operators to defend against >them. >NEW: The document informed on the potential routing security issue, and >analyzed ways for operators to defend against them. That does not solve the point I was trying to make. The point is this: this (the sentence above) is the only place in the draft where an unexpected traffic flow is characterized as a ³potential routing security issue². If you¹re going to characterize it that way, then I think you should explain more: why is is a security issue, what is the effect, what can be done to avoid it, etc. You mention that the security focus is no more; that¹s in line with what Joel wrote (in the thread related to Kathleen¹s comments: On 9/1/15, 12:11 PM, "iesg on behalf of joel jaeggli" <[email protected] on behalf of [email protected]> wrote: >We worked pretty hard to keep both the attack terminology out of the >document and to keep the focus on the non-malicious action of ordinary >actors. I think it's better that we don't lump that in with malicious >action of varying varieties. I fully agree! You can make the decision, but if it was me, I would just take the sentence out. Thanks! Alvaro. _______________________________________________ GROW mailing list [email protected] https://www.ietf.org/mailman/listinfo/grow
