Subject: RE: [RPSEC] Charter Bashing...

From: [email-masked]
Date: Mon, 8 Apr 2002 16:27:20 -0400 (EDT)

>Perhaps there should be some doc that lays out what the
>concept and definition of a 'threat' is, including such things as
>inentional and unintentional misconfigurations....

This is related to a comment you made earlier, that I'm just now getting
around to responding to:

>Do we want to include things which
>aren't attacks, but rather things which are 'mistakes,' or
>'configuration errors,' or 'implementation errors?' I think we
>probably do, but if anyone has a different opinion.... 

I think we certainly do want to consider "mistakes", "unintentional
misconfigurations", "configuration errors," and "implementation
errors" as examples of mis-behavior.
    
But I strongly doubt that we would be able to distinguish accidents
and mistakes from deliberate malicious attacks.  I don't think that
it matters one whit to yahoo or ebay whether the mis-announcement
of their server network is the result of maliciousness or cluelessness.
They'd like the routing to work properly in either case.

Anything that can happen by accident can be made to happen on purpose
(and vice versa, I suppose).  Maliciousness vs. cluelessness is an
issue of guilt and liability and is best left to lawyers (which is
probably the one whit where it does matter to yahoo and ebay :-)).

--Sandy

_______________________________________________
RPSEC mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rpsec

---

From: Russ White <[email-masked]>
Date: Tue, 9 Apr 2002 08:03:43 -0400 (EDT)

Okay, we'll take it that failures, misconfigurations, and attacks
are all in the charter. I don't think we need any change in the
proposed charter for this, but we could explicitely add them in
(?)....

:-)

Russ

> probably the one whit where it does matter to yahoo and ebay :-)).

__________________________________
[email-masked] CCIE <>< Grace Alone