Subject: [savi] proposed revisions to draft-ietf-savi-threat-scope

From: "Joel M. Halpern" <[email-masked]>
Date: Tue, 09 Apr 2013 11:40:20 -0400

I have chatted with Stephen (thanks Stephen, the Skype call was VERY 
helpful) about his discuss points.  I believe we have the agreements below.

Ted, do you want me to make those now, or should I wait till after the 
Thursday call.

----------
First, I found the following old agreement which I missed, which will help:

Existing sentence:
SAVI is aimed at providing locally more specific protection, with the 
benefit of better local behavior and local traceability, while also 
providing better compliance with the cases dealt with by BCP 38.

Proposed repair:
SAVI is aimed at providing locally more specific protection, with the 
benefit of better local behavior and, in conjunction with appropriate 
logging, better local traceability, while also providing better 
compliance with the cases dealt with by BCP 38.

Existing Sentence:
This both that the information be useable (logging), and that the 
information be accurate, i.e. that no other machine could have been 
using that address.

Proposed repair, with typo fix, and grammar repair:
Thus both that the information be useable (appropriate logging), and 
that the information be accurate (SAVI), i.e. that no other machine 
could have been using that address, are useful to the enterprise operator.
----------

Second, I will add a paragraph after he first paragraph of section 8.1 
saying roughly:

Collection of binding logging information is helpful for detecting and 
understanding internal spoof events.  For spoof prevention and analysis 
information, it is sufficient to keep binding logs for the lifetime of 
the bindings.  Spoof event reports would clearly have longer 
significance.  Deleting the logs in a timely fashion can help address 
user privacy issues.

---------

For comment 1:
Current:
Source address validation is necessary in order to detect and reject 
spoofed packets at the IP layer in the network,

Proposed replacement:
Source address validation is necessary in order to detect and reject IP 
spoofed packets in the network,

-------
The above are hoped to resolve comment 1.
-------

For comment 3, in the definition of Spoofing, add "currently" before 
"properly claimed".

-------

For comment 4, if we can be clear that SAVI is concerned with the IP 
source address checking in IP packets, and IP address claims and 
assignments in IP claiming or assignment messages, that would help 
address the concern.
Suggested approach is to add a definition of this, and reference that in 
the introduction of section 4.

---------

As agreed in the earlier email exchange, for comment 9, in section 6 
change "then it is possible to respond" to read "this can help in 
responding".

---------

For comment 11, add a second sentence after the first one in section 8.1 
saying "In some circumstances this binding data may be considered 
personally identifying information."

------

Agreed to clear points 6 and 10 in the discuss.

For completeness, noting here that I will add the expansion of "LAND" 
that Stephen found for me.

---

From: Stephen Farrell <[email-masked]>
Date: Tue, 09 Apr 2013 16:47:09 +0100

Hi Joel,

Those all look good to me and enough to get this cleared
maybe with wordsmiting when we have a revised I-D. I think
the only one that might need wordsmithing is the one about
discuss point 4 ("address claiming messages") and I'm
happy that you and I have the same idea on what to do for
that. The others should all be good to go as per your text
below.

Thank you and all for your patience,
Stephen.

On 04/09/2013 04:40 PM, Joel M. Halpern wrote:
> _______________________________________________
> savi mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/savi

---

From: Ted Lemon <[email-masked]>
Date: Tue, 9 Apr 2013 16:37:29 +0000

On Apr 9, 2013, at 11:40 AM, "Joel M. Halpern" <[email-masked]> wrote:
> Ted, do you want me to make those now, or should I wait till after the Thursday call.

I would like to see a revision of the document prior to the call.

Given that the SAVI working group has been Cc'd on this whole exchange, I wonder, informally, if anyone in that working group has any feelings about these changes that they would like to share with us prior to the telechat.   My assumption is that these changes have all been editorial improvements that do not change the core meaning of the document.

---

From: "Jun Bi" <[email-masked]>
Date: Wed, 10 Apr 2013 00:56:58 +0800

Yes, a revision before the call is better.

Thanks,
Jun

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Ted
Lemon
Sent: Wednesday, April 10, 2013 12:37 AM
To: Joel M. Halpern
Cc: <[email-masked]>; SAVI Mailing List; IESG;
Stephen Farrell
Subject: Re: [savi] proposed revisions to draft-ietf-savi-threat-scope

Thursday call.

Given that the SAVI working group has been Cc'd on this whole exchange, I
wonder, informally, if anyone in that working group has any feelings about
these changes that they would like to share with us prior to the telechat.
My assumption is that these changes have all been editorial improvements
that do not change the core meaning of the document.