Subject: Re: [secdir] secdir review of draft-cheshire-dnsext-nbp-09.txt

From: Stuart Cheshire <[email-masked]>
Date: Wed, 01 Dec 2010 08:54:36 -0800

On 1 Nov 2010, at 2:46, Juergen Schoenwaelder wrote:

> I have reviewed this document as part of the security directorate's
> ongoing effort to review all IETF documents being processed by the
> IESG.  These comments were written primarily for the benefit of the
> security area directors.  Document editors and WG chairs should treat
> these comments just like any other last call comments.
> 
> The informational draft discusses requirements for a IP replacement of
> AppleTalk's Name Binding Protocol (NBP). As an individual submission,
> there is likely little value in commenting on the content. However, I
> would have appreciated if the authors would have discussed security as
> a requirement for an NBP replacement. I know that flexible discovery
> is often pretty much as odd with security, having "security measures
> appropriate to the environment in which" an NBP replacement "will be
> used" could have been an explicit requirement.

Can you propose some specific text you would like to see in the document?

> Editorial nit:
> 
> On page 9, the DNS name "printer1.ietf.org" should probably changed to
> "printer1.example.com".

Fixed.

Stuart Cheshire <[email-masked]>
* Wizard Without Portfolio, Apple Inc.
* www.stuartcheshire.org

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Fri, 3 Dec 2010 18:14:49 +0100

> Can you propose some specific text you would like to see in the document?

My request is essentially to move the text currently in the security
considerations into section 3 where requirements for a replacement of
NBP are discussed. For example:

3.15 Security Requirements

   The AppleTalk Name Binding Protocol was developed in an era where
   little consideration was given to security issues. In today's world
   this would no longer be appropriate. Any modern replacement for
   AppleTalk NBP should have security measures appropriate to the
   environment in which it will be used.

The security considerations section then becomes this:

6. Security Considerations

   Security requirements for a replacement of the AppleTalk Name
   Binding Protocol are discussed in Section 3.15. Given that this
   document is a broad historical overview of how AppleTalk NBP
   worked, and does not specify any new protocol(s), detailed
   discussion of possible network environments, what protocols would
   be appropriate in each, and what security measures would be
   expected of each such protocol, is beyond the scope of this
   document.

Now that I look at this again, I also think that section 5 "IPv6
Considerations" is kind of mis-placed. It seems that section 5 should
also be a subsection of section 3 since it is establishing just
another requirement.

/js

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: +49 421 200 3587         Campus Ring 1, 28759 Bremen, Germany
Fax:   +49 421 200 3103         <http://www.jacobs-university.de/>

---

From: Stuart Cheshire <[email-masked]>
Date: Tue, 14 Dec 2010 16:12:37 -0800

On 1 Nov 2010, at 2:46 AM, Juergen Schoenwaelder wrote:

> On page 9, the DNS name "printer1.ietf.org" should probably changed  
> to "printer1.example.com".

We'll update the example in the document, but I have a question:

RFC 2606 states that names like example.com "can be used as  
examples". I agree that when writers *want* to use a vendor-neutral  
example it's useful to have these names available, but are they  
mandatory? Is there an RFC which states that *all* examples MUST use  
example.com?

I've been seeing this a lot recently. Any time someone uses an  
example name other than the RFC 2606 example names, people leap on  
them and tell them this is not allowed and all RFCs have to use only  
the RFC 2606-sanctioned example names. Is this true? There's a big  
difference between saying "these names are available for use if you  
want" and "these names are mandatory and you're not allowed to use  
any others".

---

From: Donald Eastlake <[email-masked]>
Date: Wed, 15 Dec 2010 04:02:49 -0500

As the principle author of 2606, I believe they were intended to be
encouraged but not mandatory.

For some time there has been an increasingly hardened attitude about
this in the IESG and, basically, you won't be allowed to use other
names unless there is a good reason a 2606 name won't serve the
purpose or possibly if you are doing a minor update version of an
existing RFC and don't want to disturb it more than necessary.

>> On page 9, the DNS name "printer1.ietf.org" should probably changed to

Why not make the minimal change and use printer1.example.org?

Donald

> RFC 2606 states that names like example.com "can be used as examples". I
> agree that when writers *want* to use a vendor-neutral example it's useful
> to have these names available, but are they mandatory? Is there an RFC which
> states that *all* examples MUST use example.com?
>
> I've been seeing this a lot recently. Any time someone uses an example name
> other than the RFC 2606 example names, people leap on them and tell them
> this is not allowed and all RFCs have to use only the RFC 2606-sanctioned
> example names. Is this true? There's a big difference between saying "these
> names are available for use if you want" and "these names are mandatory and
> you're not allowed to use any others".
>