Subject: Re: IANA Considerations

From: Bruce Lilly <[email-masked]>
Date: Thu, 23 Jun 2005 16:23:19 -0400

>  Date: 2005-06-23 12:45
>  From: Ned Freed <[email-masked]>

> Which in turn works because there are always security considerations - the
> closest thing to valid empty security considerations section  we have is one
> that says "this entire document is about security". A section that simply says
> "there are no security considerations here" is invalid on its face and
> indicates insufficient review has been done.

Possible counterexamples:

RFC 2234:
   Security is truly believed to be irrelevant to this document.

RFC 3935:
   Considering security is one of the core principles of sound network
   engineering for the Internet.  Apart from that, it's not relevant to
   this memo.

_______________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf

---

From: Ned Freed <[email-masked]>
Date: Thu, 23 Jun 2005 13:38:25 -0700 (PDT)

>    Security is truly believed to be irrelevant to this document.

I remember this one. The validity of this statement was in fact questioned and
discussed.

>    engineering for the Internet.  Apart from that, it's not relevant to

First, saying that "security is a core principle" is hardly equivalent to
saying "there are no security considerations". In fact it is pretty much the
opposite.

Second, I actually think this is a case where some discussion of how security
relates to the mission of the IETF would actually have been appropriate. Had I
been on the IESG at the time I would have voted DISCUSS on this one, but
because the section is IMO incomplete, not because it says there are no
security considerations.

In any case, you've found one document where there arguably were no security
considerations. Fine, so I should have said "almost always" instead of
"always". It's still a red flag when a document says there's aren't any
security considerations because such documents are rare. But documents
not having IANA considerations are very common, so the same princples
don't apply.

				Ned

---

From: David Hopwood <[email-masked]>
Date: Fri, 24 Jun 2005 00:57:05 +0100

Bruce Lilly wrote:
> RFC 2234 [ABNF]:

It's not completely irrelevant: ABNF constructions that may be confusing
(of which the RFC mentions several instances) are a possible contributing
factor to security bugs when implementing specifications that use ABNF.

-- 
David Hopwood <[email-masked]>