Subject: Re: [sacm] [draft-ietf-sacm-requirements] DM-008: Providence (#31)

From: Nancy <[email-masked]>
Date: Fri, 26 Jun 2015 20:16:37 -0700

Hi Jim,

DM-011 is about origination time, so I'm not sure what you being by your comment so am thinking its not the right DM requirement you're referring to?

Thanks, Nancy

---
Reply to this email directly or view it on GitHub:
https://github.com/sacmwg/draft-ietf-sacm-requirements/issues/31#issuecomment-115949118

---

From: Jim Schaad <[email-masked]>
Date: Fri, 26 Jun 2015 20:33:19 -0700

For consistency I am still referring to it by the original number.  So it is now DM-09.

---
Reply to this email directly or view it on GitHub:
https://github.com/sacmwg/draft-ietf-sacm-requirements/issues/31#issuecomment-115952669

---

From: Nancy <[email-masked]>
Date: Sat, 27 Jun 2015 23:01:49 -0700

Thanks.  So, the text does refer to the SACM component as being the provider of information; would it help if it was updated to state "For example, a provider endpoint could share self-reported data (e.g. in the case of it also being the target endpoint) vs. data collected from a
    different SACM endpoint or by some externally-observed data"

To answer your question, the provider could be doing either; but the intent is for the data to be shared by a provider.

---
Reply to this email directly or view it on GitHub:
https://github.com/sacmwg/draft-ietf-sacm-requirements/issues/31#issuecomment-116203664

---

From: henkbirkholz <[email-masked]>
Date: Sun, 28 Jun 2015 11:32:02 -0700

The proposed text for DM-009 (was DM-011) is now:
"The data model MUST include the ability for providers to identify the data origin. For example, a provider endpoint could share self-reported data (e.g. in the case of it also being the target endpoint) vs. data collected from a different SACM endpoint or by some externally-observed data".

Does the proposed text imply and differentiate the following three (potential) scenarios?
1.) "a provider endpoint could share self-reported data (e.g. in the case of it also being the target endpoint)":
I.e. there is a SACM component located on the Target Endpoint that collects data locally and provides that data to other SACM components.
2.) "data collected from a different SACM endpoint":
I.e. there is a SACM component located on an endpoint different than the Target Endpoint that collects data about the Target Endpoint via (and this is where maybe clarification is needed) native interfaces/remote API over the network, and provides that data to other SACM components.
3.) "data collected from a different SACM endpoint or by some externally-observed data":
I.e. there is a SACM component located on an endpoint different than the Target Endpoint that can observe network behavior about the Target Endpoint, and provides that data to other SACM components.

If so, the scope of "data origin" exceeds "which Endpoint is it coming from". As it is phrased now, the scope of the concept "data origin" seems to include something like "acquisition method" or even "method data is created with". This should be clarified or at the very least be addressed and elaborated in drafts that build on this requirement.

In any case, there seems to be a strong relationship between this proposed text and Issue https://github.com/sacmwg/draft-ietf-sacm-terminology/issues/11 ("categories of Endpoint Attributes that depend on their provenance/origin") - which is good!

---
Reply to this email directly or view it on GitHub:
https://github.com/sacmwg/draft-ietf-sacm-requirements/issues/31#issuecomment-116312047

---

From: henkbirkholz <[email-masked]>
Date: Sun, 28 Jun 2015 11:49:30 -0700

In the context of this draft, terms, such as "self-reported" or "provider endpoint", could be deictic terms and are probably not completely self-explaining. An option to remedy this without making the text in the requirements draft more complicated could be to include them in the terminology draft (update -07) and then map them to more precise definitions that use standardized (and agreed upon) terms.

---
Reply to this email directly or view it on GitHub:
https://github.com/sacmwg/draft-ietf-sacm-requirements/issues/31#issuecomment-116312888

---

From: Jim Schaad <[email-masked]>
Date: Sun, 28 Jun 2015 16:49:25 -0700

I am not overly happy with the "For example..." text.  Part of the problem is the way that 'endpoint' is used as a term within SACM.  Clearer text to me would be:

For example, a provider needs to differentiate between data that is self-reported vs data that is collected by a different SACM endpoint by tagging the identity of the SACM endpoint that reported the data.   The origin of the data may change the way that data is versioned on the provider, as the data reported by different entities can be different.

I find the use of 'endpoint',while technically correct, in conjunction with provider to be confusing.  The reason is that I generally think of endpoints as what data is being collected about rather than being the collection of everything that is on the system (and perhaps even better than that).  Note that 'provider' is in the terminology draft.

---
Reply to this email directly or view it on GitHub:
https://github.com/sacmwg/draft-ietf-sacm-requirements/issues/31#issuecomment-116361248