Hi Kristian,
On 02.02.18 08:44, Kristian Larsson wrote: > Mahesh, > > I've reviewed this model, I think I largely caused the last couple of > updates to it late last year. Overall I think it is a good model. > Placement of feature-statements could be debated - no clear answers. > object groupings is something I would like to see in the model but it > was always deferred. > > > On 2018-01-22 16:50, Kent Watsen wrote: >> Hi Mahesh, >> >> Thanks, it doesn't get much more concrete then a pull request ;) >> >> Okay, so from a chair/shepherd perspective, can folks please consider >> this update to -15 as the LC solution to removing the open issue >> Juergen found in the draft? >> >> As a contributor, I don't think the name of the groupings or their >> description statements should allude to something that doesn't exist >> yet. Rather than e.g. "source-or-group", could it be instead >> something like "source-type"? > > +1 > >> Also, the update seems to be for both when specifying networks as >> well as when specifying port-ranges, but the original issue (see >> below) only mentioned addresses - is the pull-request actually what's >> needed and the description of the issue in Section 8 is incomplete? >> >> 8. Open Issues >> >> o The current model does not support the concept of >> "containers" >> >> used to contain multiple addresses per rule entry. > > Object groupings are useful whenever there are many of something. > There are usually more address entries than ports, so perhaps more > useful for addresses, but it can still be useful to say "NFS-PORTS" > and mean all the ports that NFS use (god knows what they are). > > Other have mentioned scale ACL and that it can be solved in other > ways. To me, this sort of object-groupings is not about optimising > things for the hardware but rather making it easy for me to write > rules. I think it is paramount for security that ACLs can be easily > read and understood. If we do not understand them, then we cannot say > they are effective and secure. Object groupings greatly improves the > readability of ACLs and thus makes it easier to write secure ACLs. > > I understand the authors wishes to get the first version out the door > but I can't help but wonder if it isn't just easier to add in object > groupings now. It's not that damn complicated (they are just lists). > If not, I'm happy to work with them on the next version which could > include object groupings. Please let's aim for the next version. This document just completed what I think is its FIFTH last call, which to me is nothing short of insane. Eliot > > As for the PR to add choices, there seems to be an extra container > inserted. I also made a comment on GitHub. > At the very least, I think it would be best if this PR is fixed and > merged before we proceed. > > kll > > _______________________________________________ > netmod mailing list > [email protected] > https://www.ietf.org/mailman/listinfo/netmod
signature.asc
Description: OpenPGP digital signature
_______________________________________________ netmod mailing list [email protected] https://www.ietf.org/mailman/listinfo/netmod
