Subject: [Suit] Spencer Dawkins' Yes on charter-ietf-suit-00-08: (with COMMENT)

From: Spencer Dawkins <[email-masked]>
Date: Wed, 29 Nov 2017 08:33:02 -0800

Spencer Dawkins has entered the following ballot position for
charter-ietf-suit-00-08: Yes

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/charter-ietf-suit/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Thanks for doing this one.

For "While there are many proprietary firmware update mechanisms in use today,
there is a lack of a modern interoperable approach of securely updating the
firmware in IoT devices", perhaps "there is no modern interoperable approach
allowing secure updates to firmware in IoT devices" might be easier to read.

Since you mention IoTSU, perhaps it's worth providing a pointer to the workshop
report, now available as https://datatracker.ietf.org/doc/rfc8240/.

I wasn't able to connect "In particular this group aims to publish several
documents, namely: - An IoT firmware update architecture that includes a
description of the involved entities, security threats, and assumptions. - One
or more manifest format specifications"

with

"The initial focus of this group will be development of the contents of a
manifest".

So, the initial focus of the group is *not* to specify an architecture? I lack
comprehension.

As an aside, as Adam noted, if that's a bullet list with two list elements, it
would be clearer if it was formatted that way :-)