Subject: Re: [sacm] [draft-ietf-sacm-requirements] DM-008: Providence (#31)

From: Jim Schaad <[email-masked]>
Date: Mon, 04 May 2015 08:52:54 -0700

The reference in item 1 should have been DM-011 not DM-008.  Sorry about that.

---
Reply to this email directly or view it on GitHub:
https://github.com/sacmwg/draft-ietf-sacm-requirements/issues/31#issuecomment-98763526

---

From: ncamwing <[email-masked]>
Date: Wed, 06 May 2015 22:43:11 -0700

Ah, yes....I agree!  I can remove this one....

Thanks, Nancy.

---
Reply to this email directly or view it on GitHub:
https://github.com/sacmwg/draft-ietf-sacm-requirements/issues/31#issuecomment-99727677

---

From: llorenzin <[email-masked]>
Date: Fri, 08 May 2015 13:29:19 -0700

These are two separate items and both need to be retained; clearly, we do need to clarify them.
The requirement for DM-008 is to be able to identify data from a specific provider - for example, to allow SACM consumer to request all data from Provider A, or data only from Provider A among a set of providers.  The requirement in DM-011 is to be able to identify the original source of the data - e.g. endpoint self-reported data vs. vs. data collected from an endpoint by some third party vs. externally-observed data.

---
Reply to this email directly or view it on GitHub:
https://github.com/sacmwg/draft-ietf-sacm-requirements/issues/31#issuecomment-100353094

---

From: ncamwing <[email-masked]>
Date: Fri, 08 May 2015 16:00:59 -0700

Hi Lisa,
I like your clarifications and can keep both with your examples for better clarity.  But I think I will rename DM-011 from "Provenance" to "Data Source" as I am not sure that we can really provide a full chain of custody (my definition of provenance) of a piece of data as the chain may be very large, but rather to have the provider specify per your example whether it is the originator (self-reported) vs. collected from some other source w/o forcing full chain of custody.

OK?

    Nancy.

---
Reply to this email directly or view it on GitHub:
https://github.com/sacmwg/draft-ietf-sacm-requirements/issues/31#issuecomment-100390664

---

From: Jim Schaad <[email-masked]>
Date: Wed, 13 May 2015 22:17:35 -0700

We still need text to do the clarifications from Lisa.

---
Reply to this email directly or view it on GitHub:
https://github.com/sacmwg/draft-ietf-sacm-requirements/issues/31#issuecomment-101916078

---

From: Nancy <[email-masked]>
Date: Wed, 20 May 2015 14:32:05 -0700

Hi,
I did make changes in -05,  what used to be DM-008 renumbered and I updated it as:

DM-006  Provider identification: The interfaces and actions in the
    data model MUST include the ability to identify data from a specific
    provider.  For example, a SACM consumer should be able to request
    all data to come from a specific provider (e.g.  Provider A) as
    there can be a larger set of providers.

and the DM-011 Provenance was renumbered, renamed and updated text is now:
DM-009  Data source: The data model MUST include the ability for
    providers to identify the data origin.  For example, a provider
    endpoint could share self-reported data vs. data collected from a
    different SACM endpoint or by some externally-observed data.

Does that help, or do you need further clarifications?

Thanks, nancy

---
Reply to this email directly or view it on GitHub:
https://github.com/sacmwg/draft-ietf-sacm-requirements/issues/31#issuecomment-104045488

---

From: Jim Schaad <[email-masked]>
Date: Wed, 27 May 2015 14:49:04 -0700

Suggestion in DM-006- s/(e.g. Provider A)/(e.g. a specific collector or evaluator)/
 
In DM-011 - Is the data being shared by a provider endpoint, or is the data being shared about the provider endpoint?

For example, an endpoint could share self-reported data, a data collector could share information about the endpoint or externally configured data could be shared about the endpoint.

---
Reply to this email directly or view it on GitHub:
https://github.com/sacmwg/draft-ietf-sacm-requirements/issues/31#issuecomment-106088377