Subject: [Ntp] Zaheduzzaman Sarker's No Objection on draft-ietf-ntp-port-randomization-06: (with COMMENT)

From: Zaheduzzaman Sarker via Datatracker <[email-masked]>
Date: Wed, 02 Jun 2021 06:13:56 -0700

Zaheduzzaman Sarker has entered the following ballot position for
draft-ietf-ntp-port-randomization-06: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-ntp-port-randomization/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Thanks for this document. Thanks to all the reviewers, specially Brian Trammell
for his TSVART review.

I have two observations,

    *   it says "This issue has been tracked by US-CERT with VU#597821, and has
    been
   assigned CVE-2019-11331." Please provide proper reference to the mentioned
   terminologies and assignment.

    *   removal of section 5: I don't think implementation status is a bad idea
    to be included in the memo. If not in a section, may be as appendix.

---

From: Fernando Gont <[email-masked]>
Date: Fri, 4 Jun 2021 03:29:19 -0300

Hello, Zaheduzzaman,

Thanks so much for your comments! -- In-line...

On 2/6/21 10:13, Zaheduzzaman Sarker via Datatracker wrote:
[....]
>     terminologies and assignment.

Does this look better:

    This issue has been assigned CVE-2019-11331 [VULN-REPORT].

where:

    [VULN-REPORT]
               The MITRE Corporation, "CVE-2019-11331", April 2019,
               <https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-
               2019-11331>.

?

>      to be included in the memo. If not in a section, may be as appendix.

Typically, these sections are removed (thereś an RFC on the topic). But 
I wouldn't mind myself to e.g. keep the Implementation Status in an 
Appendix.

Thanks!

Regards,
-- 
Fernando Gont
e-mail: [email-masked] || [email-masked]
PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1

---

From: Zaheduzzaman Sarker <[email-masked]>
Date: Fri, 4 Jun 2021 08:10:22 +0000

Hi,

Thanks for addressing my comments. Please see inline below.

BR
Zahed

On 2021-06-04, 08:29, "Fernando Gont" <[email-masked]> wrote:

    Hello, Zaheduzzaman,

    Does this look better:

    where:

        [VULN-REPORT]

    ?

Yes, this is somewhat better. I would suggest following

   This issue has been assigned CVE-2019-11331 [VULN-REPORT], CVE is list of publicly disclosed cybersecurity vulnerabilities which feeds the US National Vulnerability Database (NVD) [NVD].

[NVD] https://nvd.nist.gov/ 

If there is no one screaming at it then that will be a good idea.

BR
Zahed