Subject: Re: [OPSAWG] Gen-ARTLCreviewofdraft-ietf-opsawg-snmp-engineid-discovery-02.txt

From: "Romascanu, Dan (Dan)" <[email-masked]>
Date: Wed, 9 Jul 2008 16:51:52 +0200

Juergen, Scott,

Do you have enough feedback to declare WG consensus on this issue? 

Can we expect a new I-D before the pre-Dublin submission cutoff on
Monday? 

Thanks and Regards,

Dan

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Juergen Schoenwaelder
> Sent: Thursday, June 26, 2008 11:00 AM
> To: David Harrington
> Cc: 'General Area Review Team'; [email-masked]; 
> [email-masked]
> Subject: Re: 
> [OPSAWG]Gen-ARTLCreviewofdraft-ietf-opsawg-snmp-engineid-disco
> very-02.txt
> 
> On Thu, Jun 26, 2008 at 08:56:14AM +0800, David Harrington wrote:
>  
> > I think the benefit to operators is greater than the risk of giving 
> > the same benefit to attackers. I am not convinced this 
> information is 
> > sensitive.
> 
> I though security considerations should spell out potential 
> risks so that people deploying technology can think about 
> them and take an informed decision. How can we claim that we 
> understand the benefit risk trade-offs?
> 
> An an editor, I need to understand the WG consensus. I 
> currently see three options on the table:
> 
> a) document the potential information leakage associated with
>    snmpEngineID discovery
> 
> b) declare that this potential information leakage is a feature that
>    is RECOMMENDED to support
> 
> c) remove all discussion about this issue and simply stay silent,
>    following the spirit of the USM standard
> 
> /js
> 
> -- 
> Juergen Schoenwaelder           Jacobs University Bremen gGmbH
> Phone: +49 421 200 3587         Campus Ring 1, 28759 Bremen, Germany
> Fax:   +49 421 200 3103         <http://www.jacobs-university.de/>
> _______________________________________________
> OPSAWG mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/opsawg
> 
_______________________________________________
OPSAWG mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/opsawg

---

From: [email-masked] (Scott O. Bradner)
Date: Wed, 9 Jul 2008 11:54:01 -0400 (EDT)

> Do you have enough feedback to declare WG consensus on this issue?=20

I think so - pls go ahead

Scott

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Mon, 14 Jul 2008 15:37:13 +0200

> Can we expect a new I-D before the pre-Dublin submission cutoff on

I have submitted a new version which updates the references and tries
to get the security considerations issue resolved. But this needs to
be checked since I am not 100% sure I got the wording right so that
people agree to what it says.

Since automatic ID submission has stopped to work for me, it will
likely take some days before the new version shows up since the ID is
now in the manual processing queue.

/js

---

From: Brian E Carpenter <[email-masked]>
Date: Tue, 15 Jul 2008 10:32:22 +1200

FWIW I'm happy with the text in the -03 draft; not quite what
I originally expected, but completely logical.

Thanks
   Brian

On 2008-06-27 05:56, Randy Presuhn wrote:
> Hi -
> 
>> From: "Juergen Schoenwaelder" <[email-masked]>
>> To: "David Harrington" <[email-masked]>
>> Cc: "'Randy Presuhn'" <[email-masked]>; "'General Area Review Team'" <[email-masked]>; <[email-masked]>;
> <[email-masked]>
>> Sent: Thursday, June 26, 2008 12:59 AM
>> Subject: Re: [OPSAWG]Gen-ARTLCreviewofdraft-ietf-opsawg-snmp-engineid-discovery-02.txt
> ...
>> An an editor, I need to understand the WG consensus. I currently see
>> three options on the table:
>>
> perhaps with a note that this information can get out in other ways
> 
>  I'd quibble with the "to support" - we're not talking about
> an implementation decision, but rather a deployment / usage decision,
> since the VACM configuration is what would determine how much "leaks",
> beyond what the protocol itself exposes.
> 
> ...
> So I agree in spirit with a+b
> 
> Randy
> 
> 
> Gen-art mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/gen-art
>