Re: Last Call: draft-ietf-opsec-filter-caps (Filtering and Rate Limiting Capabilities for IP Network Infrastructure) to BCP

[Ron Bonica <rbonica@juniper.net>]

Folks,

Please disregard my previous email, instructing the authors to publish
as INFORMATIONAL. I hadn't read Danny's objection yet when I sent that
instruction.

Danny, Barry, please continue this dialog and try to reach some
consensus. In the mean time, I will retreat into my smoke-filled room to
figure out if there is any RFC that provides guidance in case you can't
reach consensus between one another.

                               Ron


Danny McPherson wrote:
> 
> On Jun 28, 2007, at 1:59 AM, George Jones wrote:
> 
>> On 6/27/07, Danny McPherson <danny@tcb.net> wrote:
>>
>> See the working group charter and framework documents:
>>
>> http://www.ietf.org/html.charters/opsec-charter.html
>>
>> http://www.ietf.org/internet-drafts/draft-ietf-opsec-
>> framework-05.txt  Sec 2.4
>>
>> This was hashed out a long time ago.
> 
> 
> In the charter you use the phrase "capability needed to operate
> network elements in a secure fashion".  In the framework document
> you say "Capability documents list capabilities needed to support
> security practices".  And finally, the filter-caps document itself  states
> "This document lists filtering and rate limiting capabilities needed
> to support those practices".
> 
> So you're telling that all the opsec work is attempting to avoid the
> notion of "requirements", yet all this output represents things that
> are "needed" by the opsec community.  If these things really are
> "needed" and a good idea for the community and consensus exists
> around them, then why would this not be BCP?
> 
> From the first two paragraphs of the WG charter:
> 
> "The goal of the Operational Security Working Group is to codify
> knowledge gained through operational experience about feature sets
> that are needed to securely deploy and operate managed network
> elements providing transit services at the data link and IP
> layers.
> 
> It is anticipated that the codification of this knowledge will be
> an aid to vendors in producing more securable network elements,
> and an aid to operators in increasing security by deploying and
> configuring more secure network elements."
> 
> BCP would seem to me to be the logical output of a good portion of
> work here and it's even what the IESG seemed to believe given their
> IETF LC document status.
> 
> I submit that simply deferring and publishing work here as
> Informational, without better reason, is marginalizing at the very core
> what opsec was meant to provide - a place to generate consensus
> and "codify knowledge gained through operational experience about
> feature sets that are needed to securely deploy and operate managed
> network elements [.....]".
> 
> -danny
> 
> 
> 
>