Subject: [Int-area] Please review my Internet Draft

From: Mykyta Yevstifeyev <[email-masked]>
Date: Tue, 2 Nov 2010 17:11:12 +0200

Hello!

I have recently made an Internet-Draft 'draft-yevstifeyev-hctp'
defining Hardware Configuration transfer Protocol. I think
the Internet area WG is the best place to discuss it. So
please review the I-D (find it here, please

https://datatracker.ietf.org/doc/draft-yevstifeyev-hctp/

)

Thank you very much for your time.

Mykyta Yevstifeyev

---

From: Joe Touch <[email-masked]>
Date: Tue, 02 Nov 2010 09:05:26 -0700

Hi, Mykyta,

This document doesn't appear to be in-scope for INT area. It looks like 
an application protocol running over UDP. At best, it would be more 
relevant to the OPS WG.

There are a bunch of questions that are fairly obvious, though:

- why not use any of existing protocols to obtain this info?
The easiest and most obvious would be to describe the info as an XML 
profile, and use HTTP to retrieve it. Note that this doesn't mean you 
need to run it over port 80, though; there are many custom protocols 
that exchange information like this over other assigned ports using HTTP 
and XML.

- why do this over UDP?
The messages are limited in size, can be fragmented, lost, etc. If you 
use TCP you avoid those issues, and don't need to 'compress' the format 
by using bitfields (and thus can consider more than 32 kinds of device 
components)

- why would anyone allow this service?
Exposing this information seems to give exactly the detail needed to 
attack a machine. Also, there is no security in your protocol - no 
signatures, no hashes, etc. This seems like a security nightmare.

- why is this even useful?
My machine can support dozens of video resolutions; what do I respond? I 
have a variable clockrate CPU, and often run OS's in virtual partitions 
(with variable amounts of other resources) - what does that mean to you? 
Why do you even care?

Joe

On 11/2/2010 8:11 AM, Mykyta Yevstifeyev wrote:
> _______________________________________________
> Int-area mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/int-area

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Wed, 3 Nov 2010 14:08:21 +0100

On Tue, Nov 02, 2010 at 05:11:12PM +0200,
 Mykyta Yevstifeyev <[email-masked]> wrote 
 a message of 18 lines which said:

> defining Hardware Configuration transfer Protocol.

Besides Joe Touch's excellent remarks (the main one is that your data
model is way too rigid: what if I have two network cards?), why not
using a MIB, for instance derived from Host-Resources MIB (RFC 2790)?

Also, why making it dependent on IPv4?

* there is zero reason to limit yourself to one specific version of IP,
* even if you do, choosing IPv4 is strange for a protocol designed in
  2010.