Hi Qin, On Sun, Apr 12, 2020 at 8:12 PM Qin Wu <[email protected]> wrote:
> Section 2: > * "All security sensitive data (i.e., private keys, passwords, etc.) > SHOULD be overwritten ..." presents a choice. Why would an implementer not > do this? * > [Qin]: This was outcome of the discussion, see the following link: > https://mailarchive.ietf.org/arch/msg/netmod/qrU_71AkP42lnkR6KnfaMsoSgCs/ > i.e., folks concerned to restore security data and password to default > value, that's we introduce clean requirements to address this concern. > "Implementors SHOULD reboot the device or otherwise restart processes > needed to bootstrap it." leads me to the same question. > [Qin]: To make default configuration take effect, the device reboot is > recommended, but in some case, the IP address reachability of the device > may be lost, therefore bootstrapping may be needed. > For both of these I suggest mentioning in the document the reason it's a SHOULD and not a MUST, i.e., describe a situation when it might be okay to do something other than what it says. (Reminder: These are not blocking comments, just suggestions.) Thanks for considering these suggestions. -MSK
_______________________________________________ netmod mailing list [email protected] https://www.ietf.org/mailman/listinfo/netmod
