Subject: [sidr] adoption of draft-kent-sidr-adverse-actions-02

From: Declan Ma <[email-masked]>
Date: Tue, 08 Mar 2016 08:54:19 +0800

Hi all,

According to the discussions on Adverse Actions draft at IETF Yokohama meeting and the feedback from the WG mailing list, Steve and I have removed the text that caused folks concerns relating to mitigation solutions. 

I think the updated version of this draft (https://tools.ietf.org/html/draft-kent-sidr-adverse-actions-02) is ready for WG adoption. 

Chairs, please consider this a formal request to put out an adoption call.  Thanks very much.

P.S.

This request was posted on 22nd December last year, which I guess a bad time to catch anybody’s attention. So I re-post this message to the mailing list. 

Di Ma

ZDNS

---

From: Sandra Murphy <[email-masked]>
Date: Fri, 11 Mar 2016 12:05:42 -0500

This starts an adoption call for draft-kent-sidr-adverse-actions-02.

Please respond on the list if you believe the working group should adopt this draft as a work item.  The adoption call will end 25 Mar 2016.

Remember that positive support is needed for adoption. Please state whether you believe the work should be adopted and whether you will review and comment on the work.

The draft is available at https://tools.ietf.org/html/draft-kent-sidr-adverse-actions-02

—Sandy, speaking as one of the wg co-chairs

---

From: [email-masked]
Date: Wed, 16 Mar 2016 17:35:42 +0800

Support.

"sidr" <[email-masked]> 写于 2016/03/12 01:05:42:

> Please respond on the list if you believe the working group should 
> adopt this draft as a work item.  The adoption call will end 25 Mar 
2016.
> 
> Remember that positive support is needed for adoption. Please state 
> whether you believe the work should be adopted and whether you will 
> review and comment on the work.
> 
> ―Sandy, speaking as one of the wg co-chairs
> 
> 
> 
> _______________________________________________
> sidr mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sidr

---

From: Rob Austein <[email-masked]>
Date: Wed, 16 Mar 2016 16:03:08 -0400

I have read this draft, support adoption, and will review.

---

From: "Linlin Zhou" <[email-masked]>
Date: Sun, 20 Mar 2016 12:06:37 +0800

This draft looks good to me. I think this work is going to help establish
threat model in RPKI operations. So support to be adopted as WG document.

Regards,
Linlin

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of
> Sandra Murphy
> Sent: Saturday, March 12, 2016 1:06 AM
> To: sidr
> Cc: Sandra Murphy
> Subject: [sidr] adoption call for draft-kent-sidr-adverse-actions-02
> 
> Please respond on the list if you believe the working group should adopt
this
> draft as a work item.  The adoption call will end 25 Mar 2016.
> 
whether
> you believe the work should be adopted and whether you will review and
> comment on the work.
> 
> The draft is available at
> https://tools.ietf.org/html/draft-kent-sidr-adverse-actions-02
> 
> -Sandy, speaking as one of the wg co-chairs
>

---

From: "Sriram, Kotikalapudi (Fed)" <[email-masked]>
Date: Mon, 28 Mar 2016 20:38:29 +0000

I have read the draft and support adoption.

Sriram

---

From: [email-masked]
Date: Mon, 28 Mar 2016 16:43:59 -0400

I support adoption of this document. 

On Mon, 28 Mar 2016 20:38:29 +0000, "Sriram, Kotikalapudi (Fed)"  wrote:

Sriram

-----Original Message-----
From: sidr [mailto:[email-masked]] On Behalf Of Sandra Murphy
Sent: Friday, March 11, 2016 12:06 PM
To: sidr
Cc: Sandra Murphy
Subject: [sidr] adoption call for draft-kent-sidr-adverse-actions-02

Please respond on the list if you believe the working group should 
adopt this draft as a work item. The adoption call will end 25 Mar 2016.

---

From: Tim Bruijnzeels <[email-masked]>
Date: Tue, 29 Mar 2016 17:45:10 +0200

Dear working group,

I support adopting this work. I believe it's useful to think about what can go wrong. I am happy to see that this document (1) focusses on adverse actions irrespective of intentional or accidental cause, and (2) does not suggest a solution.

I do have one remaining concern, but I hope that this can be addressed: this document can be perceived as proof of 'all the things wrong / scary' about RPKI used for origin validation and/or BGPSec. However, to my knowledge, there is no similar analysis of adverse actions to IRRs. Most of the same problems exist there - and far worse: RPs do not have the benefit of object security so they would be largely unaware. I think it would be counterproductive if this wasn't clear, and the document is abused to make a point for being better of with simple IRR.

Regards
Tim

> On 11 Mar 2016, at 18:05, Sandra Murphy <[email-masked]> wrote:
>

---

From: "Carlos M. Martinez" <[email-masked]>
Date: Tue, 29 Mar 2016 17:39:30 -0300

I support adoption as well.

---

From: Randy Bush <[email-masked]>
Date: Tue, 29 Mar 2016 18:55:06 -0300

> I do have one remaining concern, but I hope that this can be
> addressed: this document can be perceived as proof of 'all the things
> wrong / scary' about RPKI used for origin validation and/or
> BGPSec. However, to my knowledge, there is no similar analysis of
> adverse actions to IRRs. Most of the same problems exist there - and
> far worse: RPs do not have the benefit of object security so they
> would be largely unaware. I think it would be counterproductive if
> this wasn't clear, and the document is abused to make a point for
> being better of with simple IRR.

this has bothered me.  thank you for expressing it far better than i
could

randy

---

From: "Carlos M. Martinez" <[email-masked]>
Date: Wed, 30 Mar 2016 09:44:45 -0300

+1

---

From: Stephen Kent <[email-masked]>
Date: Wed, 30 Mar 2016 10:27:00 -0400

Tim,

That's a fair point. Are you suggesting that we create a separate doc to 
enumerate
vulnerabilities in the IRR context, or that we add a section to this doc 
to describe,
in less detail, such vulnerabilities?

Steve

---

From: Andy Newton <[email-masked]>
Date: Wed, 30 Mar 2016 15:06:08 +0000

On Mar 30, 2016, at 10:27 AM, Stephen Kent <[email-masked]<mailto:[email-masked]>> wrote:

That's a fair point. Are you suggesting that we create a separate doc to enumerate
vulnerabilities in the IRR context, or that we add a section to this doc to describe,
in less detail, such vulnerabilities?

+1 on documenting this being a good idea.

Unfortunately, enumerating the IRR vulnerabilities would likely consume your current document.

Perhaps a companion document is more appropriate.

-andy

---

From: Randy Bush <[email-masked]>
Date: Wed, 30 Mar 2016 14:35:49 -0300

> That's a fair point. Are you suggesting that we create a separate doc
> to enumerate vulnerabilities in the IRR context, or that we add a
> section to this doc to describe, in less detail, such vulnerabilities?

for each scary point, just compare to existing irr tech.  i.e. "this is
the same problem as irr has," or "this ameliorates some of the following
irr problem."

randy