Subject: Re: [Gen-art] [OPSAWG]Gen-ARTLCreviewofdraft-ietf-opsawg-snmp-engineid-discovery-02.txt

From: "Romascanu, Dan (Dan)" <[email-masked]>
Date: Wed, 9 Jul 2008 16:51:52 +0200

Juergen, Scott,

Do you have enough feedback to declare WG consensus on this issue? 

Can we expect a new I-D before the pre-Dublin submission cutoff on
Monday? 

Thanks and Regards,

Dan

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Juergen Schoenwaelder
> Sent: Thursday, June 26, 2008 11:00 AM
> To: David Harrington
> Cc: 'General Area Review Team'; [email-masked]; 
> [email-masked]
> Subject: Re: 
> [OPSAWG]Gen-ARTLCreviewofdraft-ietf-opsawg-snmp-engineid-disco
> very-02.txt
> 
> On Thu, Jun 26, 2008 at 08:56:14AM +0800, David Harrington wrote:
>  
> > I think the benefit to operators is greater than the risk of giving 
> > the same benefit to attackers. I am not convinced this 
> information is 
> > sensitive.
> 
> I though security considerations should spell out potential 
> risks so that people deploying technology can think about 
> them and take an informed decision. How can we claim that we 
> understand the benefit risk trade-offs?
> 
> An an editor, I need to understand the WG consensus. I 
> currently see three options on the table:
> 
> a) document the potential information leakage associated with
>    snmpEngineID discovery
> 
> b) declare that this potential information leakage is a feature that
>    is RECOMMENDED to support
> 
> c) remove all discussion about this issue and simply stay silent,
>    following the spirit of the USM standard
> 
> /js
> 
> -- 
> Juergen Schoenwaelder           Jacobs University Bremen gGmbH
> Phone: +49 421 200 3587         Campus Ring 1, 28759 Bremen, Germany
> Fax:   +49 421 200 3103         <http://www.jacobs-university.de/>
> _______________________________________________
> OPSAWG mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/opsawg
> 
_______________________________________________
Gen-art mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/gen-art

---

From: [email-masked] (Scott O. Bradner)
Date: Wed, 9 Jul 2008 11:54:01 -0400 (EDT)

> Do you have enough feedback to declare WG consensus on this issue?=20

I think so - pls go ahead

Scott

---

From: Brian E Carpenter <[email-masked]>
Date: Tue, 15 Jul 2008 10:32:22 +1200

FWIW I'm happy with the text in the -03 draft; not quite what
I originally expected, but completely logical.

Thanks
   Brian

On 2008-06-27 05:56, Randy Presuhn wrote:
> Hi -
> 
>> From: "Juergen Schoenwaelder" <[email-masked]>
>> To: "David Harrington" <[email-masked]>
>> Cc: "'Randy Presuhn'" <[email-masked]>; "'General Area Review Team'" <[email-masked]>; <[email-masked]>;
> <[email-masked]>
>> Sent: Thursday, June 26, 2008 12:59 AM
>> Subject: Re: [OPSAWG]Gen-ARTLCreviewofdraft-ietf-opsawg-snmp-engineid-discovery-02.txt
> ...
>> An an editor, I need to understand the WG consensus. I currently see
>> three options on the table:
>>
> perhaps with a note that this information can get out in other ways
> 
>  I'd quibble with the "to support" - we're not talking about
> an implementation decision, but rather a deployment / usage decision,
> since the VACM configuration is what would determine how much "leaks",
> beyond what the protocol itself exposes.
> 
> ...
> So I agree in spirit with a+b
> 
> Randy
> 
>