Subject: Re: [Ntp] Warren Kumari's No Objection on draft-ietf-ntp-bcp-10: (with COMMENT)

From: Denis Reilly <[email-masked]>
Date: Thu, 17 Jan 2019 18:15:24 +0000

Hello, Warren! Thank you for your review. Sorry for the late reply. I've posted a new version of the draft which incorporate the feedback from the review.

I wish to respond to three of your points:

First, we will, of course, expand "NTF" on first use.

Second, we have changed the text around the Leap Smear event to read:
"Several operators configured their servers with leap smearing while others 
did not"

Lastly, in response to some other comments regarding MD5, we've included a reference to RFC6151 with more information on MD5's status.

Best Regards,

--
Denis Reilly  |  Technical Lead  |  [email-masked]  (585)321-5837

-----Original Message-----
From: Warren Kumari <[email-masked]> 
Sent: Wednesday, December 19, 2018 5:40 PM
To: The IESG <[email-masked]>
Cc: [email-masked]; Karen O'Donoghue <[email-masked]>; [email-masked]; [email-masked]; [email-masked]
Subject: Warren Kumari's No Objection on draft-ietf-ntp-bcp-10: (with COMMENT)

Warren Kumari has entered the following ballot position for
draft-ietf-ntp-bcp-10: No Objection

When responding, please keep the subject line intact and reply to all email addresses included in the To and CC lines. (Feel free to cut this introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-ntp-bcp/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Thank you for writing this - I found it a helpful, interesting and pleasant read.

I do have a few comments - these are just comments, feel free to ignore, etc.

Firstly, thanks for mentioning BCP-38 -- it feels like you are tilting at windmills here, but I appreciate your optimism :-)

'NTF' should be expanded on first use.

I don't have any test to suggest, but "For several hours before and after the June 2015 leap second, several operators implemented leap smearing while others did not, ..." sounds like, in June 2015 a whole bunch of operators sat down at their workstations and wrote code to implement leap smearing (the word "implemented" makes this less than clear). Perhaps "performed leap smearing"
would be clearer?

Section 4.1.  Pre-Shared Key Approach
"The MD5 hash is now considered to be too weak." -- too weak for what? (I agree, but you seem to be missing words).

Much of the test of the document seems to be "motherhood and apple pie" type advice (e.g: "Users should keep up to date on any known attacks on their selected implementation, and deploy updates containing security fixes as soon as practical."), but this is a BCP, this doesn't seem unreasonable :-)

ATTENTION: This email came from an external source.
Do not open attachments or click on links from unknown senders or unexpected emails.