Re: Last Call: draft-ietf-opsec-filter-caps (Filtering and Rate Limiting Capabilities for IP Network Infrastructure) to BCP

[Danny McPherson <danny@tcb.net>]

On Jun 28, 2007, at 1:59 AM, George Jones wrote:

> On 6/27/07, Danny McPherson <danny@tcb.net> wrote:
>
> See the working group charter and framework documents:
>
> http://www.ietf.org/html.charters/opsec-charter.html
>
> http://www.ietf.org/internet-drafts/draft-ietf-opsec- 
> framework-05.txt  Sec 2.4
>
> This was hashed out a long time ago.

In the charter you use the phrase "capability needed to operate
network elements in a secure fashion".  In the framework document
you say "Capability documents list capabilities needed to support
security practices".  And finally, the filter-caps document itself  
states
"This document lists filtering and rate limiting capabilities needed
to support those practices".

So you're telling that all the opsec work is attempting to avoid the
notion of "requirements", yet all this output represents things that
are "needed" by the opsec community.  If these things really are
"needed" and a good idea for the community and consensus exists
around them, then why would this not be BCP?

From the first two paragraphs of the WG charter:

"The goal of the Operational Security Working Group is to codify
knowledge gained through operational experience about feature sets
that are needed to securely deploy and operate managed network
elements providing transit services at the data link and IP
layers.

It is anticipated that the codification of this knowledge will be
an aid to vendors in producing more securable network elements,
and an aid to operators in increasing security by deploying and
configuring more secure network elements."

BCP would seem to me to be the logical output of a good portion of
work here and it's even what the IESG seemed to believe given their
IETF LC document status.

I submit that simply deferring and publishing work here as
Informational, without better reason, is marginalizing at the very core
what opsec was meant to provide - a place to generate consensus
and "codify knowledge gained through operational experience about
feature sets that are needed to securely deploy and operate managed
network elements [.....]".

-danny