Subject: Re: [netmod] 6087bis - Security Considerations template

From: Martin Bjorklund <[email-masked]>
Date: Mon, 06 Aug 2018 20:50:46 +0200 (CEST)

Hi,

Ladislav Lhotka <[email-masked]> wrote:
> Hi,
> 
> Shawn Emery reviewed draft-ietf-netmod-schema-mount-10 and made this
> editorial comment:
> 
> OLD:
> 
> These are the subtrees and data nodes and their sensitivity/vulnerability:
> 
> NEW:
> 
> The following should be considered for subtrees/data nodes and their
> corresponding sensitivity/vulnerability:
> 
> However, the OLD fomulation comes from RFC 6087, so perhaps this change
> should be applied in draft-ietf-netmod-rfc6087bis in the first
> place. The NEW formulation indeed looks better to me.

What is the WG's opinion on this proposed text change?  6087bis is in
AUTH48 so if it needs to be changed it must happen now.

Of course, we can update
https://trac.ietf.org/trac/ops/wiki/yang-security-guidelines even when
6087bis has been published.

If we don't want to update the template, I don't think we should
update the schema mount draft either.

/martin

> 
> Lada
> 
> -- 
> Ladislav Lhotka
> Head, CZ.NIC Labs
> PGP Key ID: 0xB8F92B08A9F76C67
> 
> _______________________________________________
> netmod mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/netmod
>

---

From: "Acee Lindem (acee)" <[email-masked]>
Date: Mon, 6 Aug 2018 19:03:40 +0000

Hi Martin, 

On 8/6/18, 2:51 PM, "netmod on behalf of Martin Bjorklund" <[email-masked] on behalf of [email-masked]> wrote:

    Hi,

Most of the existing YANG model security considerations are written a list of data nodes/subtrees and their corresponding sensitivity/vulnerability. So, if the change is accepted, new drafts would need to be written as a list of sensitivities/vulnerabilities with the data nodes and subtrees to which they apply. 

Thanks,
Acee

    Of course, we can update

    /martin

---

From: Andy Bierman <[email-masked]>
Date: Mon, 6 Aug 2018 12:21:51 -0700

> > corresponding sensitivity/vulnerability:

I do not think the new text is better.
I think 6087bis is already stuck waiting for AD approval for a tiny change
to the security template.

> update the schema mount draft either.
Andy

---

From: Martin Bjorklund <[email-masked]>
Date: Tue, 07 Aug 2018 10:46:10 +0200 (CEST)

> I do not think the new text is better.

I agree.  So I suggest we keep the text also in schema mount.

/martin