Subject: Re: [MIB-DOCTORS] [AH] questions about draft-ietf-isms-radius-vacm-11

From: Juergen Schoenwaelder <[email-masked]>
Date: Fri, 29 Oct 2010 08:20:37 +0200

MIB doctors,

one of the ISMS documents edited by Randy Presuhn departs from the
standard MIB boilerplate text. The current boilerplate says:

  Some of the readable objects in this MIB module (i.e., objects with
  a MAX-ACCESS other than not-accessible) may be considered sensitive
  or vulnerable in some network environments.

Randy changed this text to read as follows:

  Some of the readable objects in this MIB module (including some
  objects with a MAX-ACCESS of not-accessible, whose values are
  exposed as a result of access to indexed objects) may be considered
  sensitive or vulnerable in some network environments.

I believe Randy has a valid point here. Should we attempt to update
the boilerplate?

/js

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: +49 421 200 3587         Campus Ring 1, 28759 Bremen, Germany
Fax:   +49 421 200 3103         <http://www.jacobs-university.de/>

---

From: "Bert Wijnen \(IETF\)" <[email-masked]>
Date: Fri, 29 Oct 2010 09:21:59 +0200

I would thik that it is rare that index (not-accessible) objects provide
sensitive/vulnerable data. So I would rather treat it as an exception
than the general noiler plate.

But I can live with it if the majority thinks we should
change the base boiler plate.

Bert
----- Original Message ----- 
From: "Juergen Schoenwaelder" <[email-masked]>
To: <[email-masked]>
Sent: Friday, October 29, 2010 8:20 AM
Subject: Re: [MIB-DOCTORS] [AH] questions 
aboutdraft-ietf-isms-radius-vacm-11

MIB doctors,

/js

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: +49 421 200 3587         Campus Ring 1, 28759 Bremen, Germany
Fax:   +49 421 200 3103         <http://www.jacobs-university.de/>
_______________________________________________
MIB-DOCTORS mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/mib-doctors

---

From: "Romascanu, Dan (Dan)" <[email-masked]>
Date: Fri, 29 Oct 2010 10:53:46 +0200

I would prefer that we do not touch the boilerplate, but rather add text
to mentions this case as a special case in this document. It is rare
(maybe unique) that the index objects with a MAX-ACCESS of
not-accessible have a semantics that may have security implications. The
boilerplate is in place and stable for a few years, modifying it
involves work with the security ADs and approval of the IESG, and I
would prefer to undertake this overhead only if we believe that we are
dealing with more than an exception. 

Dan

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Juergen 
> Schoenwaelder
> Sent: Friday, October 29, 2010 8:21 AM
> To: [email-masked]
> one of the ISMS documents edited by Randy Presuhn departs 
> from the standard MIB boilerplate text. The current boilerplate says:
> 
> I believe Randy has a valid point here. Should we attempt to 
> update the boilerplate?
> 
> /js
> 
> --