Subject: [MIB-DOCTORS] FW: I-D ACTION:draft-mcwalter-uri-mib-00.txt

From: "Romascanu, Dan \(Dan\)" <[email-masked]>
Date: Tue, 14 Nov 2006 23:49:48 +0200

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] 
Sent: Tuesday, November 14, 2006 10:50 PM
To: [email-masked]
Subject: I-D ACTION:draft-mcwalter-uri-mib-00.txt 

A New Internet-Draft is available from the on-line Internet-Drafts
directories.

	Title		: Uniform Resource Identifier (URI) MIB
	Author(s)	: D. McWalter
	Filename	: draft-mcwalter-uri-mib-00.txt
	Pages		: 8
	Date		: 2006-11-14
	
   This MIB module defines textual conventions to represent STD 66
   [RFC3986] Uniform Resource Identifiers (URIs).  The intent is that
   these textual conventions will be imported and used in MIB modules
   that would otherwise define their own representation(s).

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-mcwalter-uri-mib-00.txt

To remove yourself from the I-D Announcement list, send a message to 
[email-masked] with the word unsubscribe in the body of 
the message. 
You can also visit https://www1.ietf.org/mailman/listinfo/I-D-announce 
to change your subscription settings.

Internet-Drafts are also available by anonymous FTP. Login with the 
username "anonymous" and a password of your e-mail address. After 
logging in, type "cd internet-drafts" and then 
"get draft-mcwalter-uri-mib-00.txt".

A list of Internet-Drafts directories can be found in
http://www.ietf.org/shadow.html 
or ftp://ftp.ietf.org/ietf/1shadow-sites.txt

Internet-Drafts can also be obtained by e-mail.

Send a message to:
	[email-masked].
In the body type:
	"FILE /internet-drafts/draft-mcwalter-uri-mib-00.txt".
	
NOTE:	The mail server at ietf.org can return the document in
	MIME-encoded form by using the "mpack" utility.  To use this
	feature, insert the command "ENCODING mime" before the "FILE"
	command.  To decode the response(s), you will need "munpack" or
	a MIME-compliant mail reader.  Different MIME-compliant mail
readers
	exhibit different behavior, especially when dealing with
	"multipart" MIME messages (i.e. documents which have been split
	up into multiple messages), so check your local documentation on
	how to manipulate these messages.

Below is the data which will enable a MIME compliant mail reader
implementation to automatically retrieve the ASCII version of the
Internet-Draft.

_______________________________________________
MIB-DOCTORS mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mib-doctors

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Tue, 14 Nov 2006 23:55:20 +0100

> http://www.ietf.org/internet-drafts/draft-mcwalter-uri-mib-00.txt

Nice, short, to the point. A few suggestions:

a) [RFC3692] seems to be never referenced - so drop it.
b) [RFC2434] seems to be never referenced - so drop it.
c) s/Jeurgen/Juergen
d) In the security considerations, I suggest to remove / reword the
   paragraphs talking about MIB objects since this MIB module does
   not define any MIB objects. Here is an attempt of a rewrite:

   --

   This module does not define any management objects.  Instead, it
   defines several textual conventions that may be imported by other
   MIB modules and used for object definitions.

   Whenever using limited-size arrays to implement objects using the
   textual conventions defined by this MIB module, implementers are
   encouraged to check length and bounds on input and memory in order
   to avoid introducing buffer overflow vulnerabilities. This advice
   is particularly important for URLs, which have frequently been
   exploited in this way in recent years.

   SNMPv1 and SNMPv2c messages are not considered secure.  It is
   recommended that the implementors consider the use of SNMPv3 messages
   and the security features as provided by the SNMPv3 framework.
   Specifically, the use of the User-based Security Model STD 62, RFC
   3414 [RFC3414] and the View-based Access Control Model STD 62, RFC
   3415 [RFC3415] is recommended.

   It is then a customer/user responsibility to ensure that the SNMP
   entity giving access to a MIB is properly configured to give access
   to the objects only to those principals (users) that have legitimate
   rights to indeed GET or SET (change) them.

   --

/js

-- 
Juergen Schoenwaelder		 International University Bremen
				 (Jacobs University Bremen as of Spring 2007)
<http://www.eecs.iu-bremen.de/>	 P.O. Box 750 561, 28725 Bremen, Germany