Subject: [mile] discussion today regarding the draft "IODEF-extension to support structured cybersecurity information"

From: "Takeshi Takahashi" <[email-masked]>
Date: Wed, 16 Nov 2011 17:49:31 +0900

Hi all,

Thank you very much for those of you who kindly provided discussion and
supports.
Based on today's discussion, the draft needs to consider the following two
issues.

1. Consider twice whether these specifications that needs user reply (such
as OCIL) should be exchanged.

In any case, Section 3 of the draft needs to be modified to clarify some of
the expected use cases of the extension.
Use cases that require instant and non-instant replies should be separately
considered.

2. Guideline for expert review needs to be discussed further

It seems to be that "specification required" is a good level for the
criteria.
Three implementations seem to be rather high bar as a criteria.
Further discussion is needed by taking the case of IPsec's case into account

Above are my understanding. (correct me if I'm wrong. Thank you !)
Let me think about them and come back to the mailing list a bit later.

Sincerely,
Take

---

From: <[email-masked]>
Date: Wed, 16 Nov 2011 04:26:52 -0500

Hi Take,

Here's my understanding of the expert review discussion:

> It seems to be that "specification required" is a good level for the criteria.

To be precise, this would be use of both the "Expert Review" (Designated Expert) and "Specification Required" (permanent and readily available public specification) IANA policies for assigning values (i.e., registering new specifications) - see RFC 5226 for the definitions of those policies.

> Further discussion is needed by taking the case of IPsec's case into account.

My understanding of the discussion was that the initial approach should be to pick a good designated expert (e.g., one of the current mile WG chairs, but that person's role as an expert reviewer would outlive conclusion of the mile WG), rely on that expert's judgment, and say nothing about what the expert is expected to review for.  Additional guidance can be provided in a future RFC if problems should emerge with the expert's review.

Thanks,
--David

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of Takeshi Takahashi
> Sent: Wednesday, November 16, 2011 3:50 AM
> To: [email-masked]
> Subject: [mile] discussion today regarding the draft "IODEF-extension to support structured
> cybersecurity information"
> 
> Hi all,
> 
> _______________________________________________
> mile mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/mile

---

From: "Takeshi Takahashi" <[email-masked]>
Date: Wed, 16 Nov 2011 18:36:35 +0900

Hi David,

Thank you for your kind clarification.
I appreciate that very much.

Sincerely,
Take

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] 
Sent: Wednesday, November 16, 2011 6:27 PM
To: [email-masked]; [email-masked]
Subject: RE: [mile] discussion today regarding the draft "IODEF-extension to
support structured cybersecurity information"

Hi Take,

criteria.

To be precise, this would be use of both the "Expert Review" (Designated
Expert) and "Specification Required" (permanent and readily available public
specification) IANA policies for assigning values (i.e., registering new
specifications) - see RFC 5226 for the definitions of those policies.

> Further discussion is needed by taking the case of IPsec's case into
account.

My understanding of the discussion was that the initial approach should be
to pick a good designated expert (e.g., one of the current mile WG chairs,
but that person's role as an expert reviewer would outlive conclusion of the
mile WG), rely on that expert's judgment, and say nothing about what the
expert is expected to review for.  Additional guidance can be provided in a
future RFC if problems should emerge with the expert's review.

Thanks,
--David

> Subject: [mile] discussion today regarding the draft "IODEF-extension 
> to support structured cybersecurity information"
> 
> Hi all,
> 
> Thank you very much for those of you who kindly provided discussion 
> and supports.
> Based on today's discussion, the draft needs to consider the following 
> two issues.
> 
> 1. Consider twice whether these specifications that needs user reply 
> (such as OCIL) should be exchanged.
> 
> In any case, Section 3 of the draft needs to be modified to clarify 
> some of the expected use cases of the extension.
> Use cases that require instant and non-instant replies should be 
> separately considered.
> 
> Above are my understanding. (correct me if I'm wrong. Thank you !) Let 
> me think about them and come back to the mailing list a bit later.
> 
> Sincerely,
> Take
> 
> 
>

---

From: <[email-masked]>
Date: Wed, 16 Nov 2011 10:30:57 -0600

Hi David, Take,

I agree with David's understanding.  I was pleased by the volume of the hums making this document a working group document…. and I was listening on Meetecho.

BTW, for those of you on the list that did not attend in person and were not crazy enough to get up in the middle of the night to listen in, http://ietf82.conf.meetecho.com/ provides recording of the supported/listed IETF sessions.  I found the quality of the feed outstanding and had no problem participating using this tool.  Thanks to those at Meetecho for making this possible.  The MILE recording is not there at this point but I think that is the intent.

Thanks.

Kent Landfield
Director Content Strategy, Architecture and Standards

McAfee, Inc.
5000 Headquarters Dr.
Plano, Texas 75024

Direct: +1.972.963.7096
Mobile: +1.817.637.8026
Web: www.mcafee.com<http://www.mcafee.com/>

From: "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Date: Wed, 16 Nov 2011 03:26:52 -0600
To: "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>, "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Subject: Re: [mile] discussion today regarding the draft "IODEF-extension to support structured cybersecurity information"

Hi Take,

Thanks,
--David

-----Original Message-----
From: [email-masked]<mailto:[email-masked]> [mailto:[email-masked]] On Behalf Of Takeshi Takahashi
Sent: Wednesday, November 16, 2011 3:50 AM
To: [email-masked]<mailto:[email-masked]>
Subject: [mile] discussion today regarding the draft "IODEF-extension to support structured
[email-masked]<mailto:[email-masked]>

_______________________________________________
mile mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/mile

---

From: Sean Turner <[email-masked]>
Date: Fri, 18 Nov 2011 12:43:27 +0800

I remember it the way David said it.

Remember specification required means anybody with a stable 
specification can get a code point.  That means WG based RFCs, 
individual/AD sponsored draft, ISE drafts, ITU, ISO, IEEE, etc. can all 
document stuff and get code points.

In practice while the WG is around, they'll be helping do the reviews 
too in most cases.  If the WG really, really, really wants to document 
what the expert is looking for, then I'd suggest doing that right before 
the WG closes (and we'll see if there's any energy for that :).  Lets 
not hold up the work trying to figure out what an expert might need to 
look at.  I keep thinking they'll know it when they see it.

spt

On 11/17/11 12:30 AM, [email-masked] wrote:
> From: "[email-masked]<mailto:[email-masked]>"<[email-masked]<mailto:[email-masked]>>
> To: "[email-masked]<mailto:[email-masked]>"<[email-masked]<mailto:[email-masked]>>, "[email-masked]<mailto:[email-masked]>"<[email-masked]<mailto:[email-masked]>>