Subject: [Ntp] Alissa Cooper's No Objection on draft-ietf-ntp-bcp-10: (with COMMENT)

From: Alissa Cooper <[email-masked]>
Date: Tue, 18 Dec 2018 12:20:31 -0800

Alissa Cooper has entered the following ballot position for
draft-ietf-ntp-bcp-10: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-ntp-bcp/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Section 2.1:

s/BCP 38 [RFC2827] was approved/BCP 38 [RFC2827] was published/ (presumably the
approval was not the seminal thing)

"It is RECOMMENDED that large corporate networks (and ISP's of any size)
implement ingress and egress filtering."

I'm not really sure what the parentheses are meant to imply here. If this is a
normative recommendation for both ISPs and large corporate networks, why
doesn't it say "ISPs and large corporate networks"?

Section 3.2:

"If time sources do not generally agree, find out the cause and either
   correct the problems or stop using defective servers."

It seems odd to frame this as a directive, especially in a paragraph where the
subject is made explicit ("operators"). I think this would make more sense if
it said "operators should find out" or "operators ought to find out."

Section 3.3:

Please fix the sentence highlighted by the Gen-ART reviewer.

Section 3.4:

"To provide protection for such abuse NTP server
   operators on large networks SHOULD deploy ingress filtering in
   accordance with BCP 38 [RFC2827]."

Why is this recommendation limited to large networks, whereas the normative
recommendation to do ingress and egress filtering in Section 2.1 applies to
ISPs of any size?

Section 3.6:

I agree with the Gen-ART reviewer that the use of "you" is inappropriate here
and should be replaced by a noun (e.g., "operators").

Section 4.1:

"Therefore, for each association, keys SHOULD be exchanged securely by external
   means, and they SHOULD be protected from disclosure."

I recognize that this is outside the bounds of the protocol, but if this
document is a BCP that is going to make these normative recommendations for
what they're worth, shouldn't they be MUSTs? If not, what are the exceptional
cases where the exchange of these keys shouldn't be secure and confidential?

Section 4.2:

Same question as Section 4.1.

Section 5:

Same comment as Section 3.2. The subject to which the directive is being given
should be named.

Section 5.2:

"It is likely to become the default behavior in other
       systems as they migrate legacy init scripts to process
       supervisors such as systemd."

For posterity it may be better to say, "At the time of this writing, it appears
likely to ..."

"Operators SHOULD be aware that when operating with the above two
   conditions, the panic threshold offers no protection from attacks."

I don't think it's appropriate to use normative language about being aware.

Section 6.1:

"Vendors of embedded devices MUST pay attention to the current state
   of protocol security issues and bugs in their chosen implementation."

Same comment as 5.2, it's inappropriate to normatively require paying attention.

Section 6.2.1:

"For more information, visit ..."

Same comment as 3.2 and 5 -- this sentence needs a subject.

---

From: "Ulrich Windl" <[email-masked]>
Date: Wed, 19 Dec 2018 08:44:40 +0100

>>> Alissa Cooper <[email-masked]> schrieb am 18.12.2018 um 21:20 in Nachricht
<[email-masked]>:
[...]
>    accordance with BCP 38 [RFC2827]."

My English is not best, but I feel a comma after "server" would make the sentence more readable, avoiding the association "server operators" (Three nouns in sequence: NTP server operators). 

[...]

---

From: Warner Losh <[email-masked]>
Date: Wed, 19 Dec 2018 08:41:42 -0700

On Wed, Dec 19, 2018 at 12:44 AM Ulrich Windl <
[email-masked]> wrote:

> My English is not best, but I feel a comma after "server" would make the
> sentence more readable, avoiding the association "server operators" (Three
> nouns in sequence: NTP server operators).
>

"... abuse, NTP-server operators ..."

I believe is the right way. The dependent clause "To provide protection
against such abuse" is the logical place for a comma. Compound nouns should
be hyphenated in this case as well, since you have a noun phrase acting as
an adjective. NTP server needn't be hyphenated in other places, unless it
modifies a noun like here.

Warner

> [...]
>
>
> _______________________________________________
> ntp mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ntp
>