Subject: [decade] Reviews of the Decade Requirements draft

From: "Woundy, Richard" <[email-masked]>
Date: Mon, 23 May 2011 15:03:50 +0000

Folks,

We would like to prepare the requirements draft, draft-ietf-decade-reqs-02<http://datatracker.ietf.org/doc/draft-ietf-decade-reqs/>, for working group last call in late June / July.

The chairs are looking for document reviews to be sent to the mailing list by Monday June 6. We already have three volunteers from our session in Prague. Additional draft reviews by the deadline would be timely and greatly appreciated.

After the authors incorporate the feedback from the reviews in a new draft iteration, the chairs expect to take the draft to WGLC.

-- Rich

---

From: "Woundy, Richard" <[email-masked]>
Date: Wed, 25 May 2011 13:11:39 +0000

Folks,

We would like to prepare the architecture draft, draft-ietf-decade-arch-01, for working group last call in July.

The chairs are looking for document reviews to be sent to the mailing list by Monday June 13. We already have three volunteers from our session in Prague. Additional draft reviews by the deadline would be timely and greatly appreciated.

-- Rich

---

From: "Rahman, Akbar" <[email-masked]>
Date: Mon, 30 May 2011 15:39:28 -0400

Hi,

Here is my review of the DECADE Requirements draft
(draft-ietf-decade-reqs-02
<http://datatracker.ietf.org/doc/draft-ietf-decade-reqs/> ):

*         Overall, the document was well thought out, informative and
well written.  I did, however, have the following comments:

General Editorial Comments:

*         For readability, all  acronyms should be defined on first
usage (e.g. VoD, CDN)

*         Should each requirement be given a simple label (e.g. PR1,
SR1)?  This will help in any future analysis of requirements compliance
tracking (or reference) in other documents.

*         The use of the key term of "IAP" (In-network storage Access
Protocol) is not consistent.  I would have expected IAP to be referred
to in each of the individual requirements in section 4.1.1. (Overall
Protocol Requirements).  But it was only used a few times.  Or did I
misunderstand the meaning of the term?  Either way this should be
clarified (i.e. the term used consistently throughout the document or
not used at all). 

Detailed Comments:

*         Section 1 (Introduction)

o   In the first paragraph there is a reference to "..primarily
applications that could be implemented using a content distribution
paradigm...".  

o   This statement invoked a classical web CDN (Content Distribution
Network) model to my mind.  However, in the next sentence it referred to
"... applications including P2P applications, IPTV, and VoD" but did not
include any type of CDN.  

o   So my question to the authors is, what did they have in mind when
referring to "a content distribution paradigm"?  And can they please
clarify the text in this section to be more precise in this regard (as I
do agree that it is good to have a clear model or paradigm in mind for
the DECADE requirements)

*         Section 2 (Terminology and Concepts)

o   With regard to the reference to the fact that the "distributed
content is typically immutable".  Does this also apply to the metadata?
And the larger question, shouldn't there be an explicit requirement on
the "immutability" data since this appears to be an underlying
requirement for the system to work?

o   I did note, however, that there was a Non-Requirement for "No
ability to update "(6.2.1) which seemed to cover the issue somewhat (but
I did find the logic a bit confusing since it was a double negative type
thinking).  Couldn't you just eliminate 6.2.1 and have an explicit
requirement for immutability?  Again, I might be missing something so
please feel free to rebut my argument. 

*         Section 3 (Requirements Structure)

o   The word "underlying" is spelled incorrectly as "underling" 

*         Section 4.1.1.2.2 and 4.1.1.3.2

o   These two requirements for "Connections to Clients" look identical

o   One should be eliminated or else the reason for having them
duplicated should be explicitly spelled out

*         Sections 4.1.2.2 and 4.1.2.4

o   The requirement in 4.1.2.2 (Indirect Transfer) looks to be logically
a subset of the requirement in 4.1.2.4 (Communication among In-network
Storage Elements)

o   Can 4.1.2.2 be eliminated?  I am okay however if you feel strongly
about keeping both of them

*         Sections 4.1.2.4 and 4.1.3.4 

o   In the HTML view, the hyper links from the TOC do not work for these
sections.  Probably because the titles are too long.

*         Section 4.1.7.4 (Credentials Not IP-Based)

o   IP addresses are dynamically and temporally assigned for nearly all
devices today (and not just mobile devices).  So in a way it seems
nearly trivial to state that the credentials should not be based on IP
addresses.  Can you re-write the requirement to make it stronger?  For
example, mandating that the credential should be cryptographically
secure?

*         Section 5 (Discovery Requirements)

o   Why is the Discovery requirement not listed under either the
Protocol or Storage requirements?  

o   Note that section 3 (Requirements Structure) implies that all the
requirements will fall under either Protocol or Storage categories.

*         Section 6.1.2 (Multiple Writing)

o   Does it really make sense for "Implementations [to] raise an error
to one of the writers"?  Is it really an error?   Also we had discussed
off line the attack scenario where a user wants to steal some existing
data by indicating that he wants to write the same data (though he does
not actually have it) because he expects the DECADE server to come back
and ask him not to bother writing it since the server already has it.
Effectively letting him steal the data.

o   Thus I think the requirement needs to be clarified

*         Section 7 (Implementation Considerations)

o   The introductory paragraph implies that the section is not finished
(i.e. "The content of this section will be migrated to an appropriate
place as the document and the Working Group progress")

*         Section 8.2 (Open Issues)

o   All of these issues should be closed (or otherwise it does not make
sense to go to WGLC)

*         Section 9 (Security Considerations)

o   The section was a bit confusing  

o   It only refers to authorization though other items were obviously
covered in the document (e.g. section 4.1.1.3)

o   Then it seems to introduce another requirement (in the 2nd
paragraph).  If this is really a requirement then it should be put in
one of the previous sections (e.g. section 4.1.1.3)

o   My suggestion is that this section cover on a high level the
philosophy to be used by DECADE for security, and all detailed
requirements should be covered in previous sections

*         Section 11.2 (Informative References)

o   The reference to DECADE Problem Statement needs to be updated to the
correct revision (i.e. Rev. -03 instead of -00)

o   Also, when I click on the PPLive reference (i.e.
http://www.pplive.com) from my office in Canada, it automatically
redirects me to http://www.pptv.com and then seems to hang there (i.e.
page never loads even after several minutes so I finally just gave up).
Was this your experience as well?

Sincerely,

Akbar

From: [email-masked] [mailto:[email-masked]] On Behalf
Of Woundy, Richard
Sent: Monday, May 23, 2011 11:04 AM
To: [email-masked]
Subject: [decade] Reviews of the Decade Requirements draft

Folks,

We would like to prepare the requirements draft,
draft-ietf-decade-reqs-02
<http://datatracker.ietf.org/doc/draft-ietf-decade-reqs/> , for working
group last call in late June / July.

The chairs are looking for document reviews to be sent to the mailing
list by Monday June 6. We already have three volunteers from our session
in Prague. Additional draft reviews by the deadline would be timely and
greatly appreciated.

After the authors incorporate the feedback from the reviews in a new
draft iteration, the chairs expect to take the draft to WGLC.

-- Rich