Subject: Re: [sacm] [EXT] Fwd: EPCP and BCP Status

From: "Haynes Jr., Dan" <[email-masked]>
Date: Thu, 6 Feb 2020 16:48:55 +0000

I just wanted to follow up and see if anyone had thoughts on the status of the EPCP document given the discussion below.

Thanks,

Danny

From: sacm <[email-masked]> on behalf of Ira McDonald <[email-masked]>
Date: Friday, December 6, 2019 at 1:10 PM
To: "[email-masked]" <[email-masked]>, Ira McDonald <[email-masked]>
Subject: [EXT] [sacm] Fwd: EPCP and BCP Status

Hi,

See note below for the context of an offline discussion this week about
the document status of EPCP that concluded on a recommentation to
change this document to Informational.

Cheers,
- Ira

---------- Forwarded message ---------
From: Ira McDonald <[email-masked]<mailto:[email-masked]>>
Date: Mon, Dec 2, 2019 at 1:35 PM
Subject: Re: [sacm] EPCP and BCP Status
Hi Danny,

This same question (about BCP status) came up recently with respect
to Guy's NetEq work on an IETF RATS I-D for RIV Attestation.

My understanding in the past has been that the IETF only published
BCP specs when they described *widely deployed* current practices
(e.g, how to secure TLS servers or DNS servers).

In the cases of EPCP and RIV, these are *not* widely deployed yet.
That's my concern about the BCP status.  I've seen several IETF
transitions from Informational to BCP status in later revisions.

Jess, Tom, Guy, Henk - thoughts?

Cheers,
- Ira

On Mon, Dec 2, 2019 at 12:44 PM Haynes Jr., Dan <[email-masked]<mailto:[email-masked]>> wrote:
Hi Everyone,

Sorry in advance for the long email, but Jess mentioned at IETF 106, it was asked whether or not EPCP should be a BCP or Informational draft. Given that, I tried to go back and dig up some information and here’s what I found :).

Originally, EPCP was a Standards Track draft and in mid-2018, we changed its status to BCP (between -02 and -03). Also, around that time, there was a question on-list [1] as to whether or not it should be Standards Track or Informational where we re-iterated its BCP status.

1.      Is it going to be a Standard Track draft? Since I see you mentioned in the abstract it mainly describes the best practices, maybe an Informational draft is more suitable?

[Danny]: I think I forgot to change that in the last draft, but, we would like to see this draft published as a BCP since it discusses the best practices for using IETF and TCG standards for endpoint assessment.

In early 2019, we made further changes to the draft to better align it with the needs of a BCP draft (see attached slides).

Unfortunately, I couldn’t find any concrete information as to why its status was changed to BCP, but, I want to say someone suggested it and as a group we thought it made sense at the time. Without that concrete information, we should look at BCP 9 [2] which states:

                    The BCP subseries of the RFC series is designed to be a way to

                  standardize practices and the results of community deliberations.  A

                  BCP document is subject to the same basic set of procedures as

                  standards track documents and thus is a vehicle by which the IETF

                  community can define and ratify the community's best current thinking

                  on a statement of principle or on what is believed to be the best way

                  to perform some operations or IETF process function.

Given this, I think it is fair to say that EPCP represents the best way to perform posture collection when the collector resides on the endpoint. Specifically, it outlines six best practices (see Section 2 of EPCP) as well as how you can implement those best practices using existing IETF/ISO/TCG standards.

With all that said, does EPCP make sense as a BCP? Or, are there specific things that it is missing that make it a better candidate for an Informational draft?

Thanks,

Danny

[1] https://mailarchive.ietf.org/arch/msg/sacm/h4DU9TFF6LxEKmMySV-ftYD21GM
[2] https://tools.ietf.org/html/bcp9#page-1-15

Thanks,

Danny
_______________________________________________
sacm mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/sacm

---

From: "Haynes Jr., Dan" <[email-masked]>
Date: Tue, 18 Feb 2020 17:26:22 +0000

Hi Everyone,

Given the feedback from Ira and Roman, we would like to change the status of the document to “standards track” and get the document published as a “proposed standard”. Please let me know if you have any concerns about this change.

Thanks,

Danny

From: sacm <[email-masked]> on behalf of Daniel Haynes <[email-masked]>
Date: Thursday, February 6, 2020 at 11:49 AM
To: Ira McDonald <[email-masked]>, "[email-masked]" <[email-masked]>
Subject: Re: [sacm] [EXT] Fwd: EPCP and BCP Status

Thanks,

Danny

Hi,

Cheers,
- Ira

---------- Forwarded message ---------
From: Ira McDonald <[email-masked]<mailto:[email-masked]>>
Date: Mon, Dec 2, 2019 at 1:35 PM
Subject: Re: [sacm] EPCP and BCP Status
Hi Danny,

Cheers,
- Ira

Thanks,

Danny

Thanks,

Danny

---

From: Ira McDonald <[email-masked]>
Date: Tue, 18 Feb 2020 12:34:13 -0500

Hi Danny,

Thanks.  I certainly prefer the "standards-track" status, which allows you
to use "MUST" and "REQUIRED" as appropriate.

Cheers,
- Ira

Ira McDonald (Musician / Software Architect)
Co-Chair - TCG Trusted Mobility Solutions WG
Co-Chair - TCG Metadata Access Protocol SG
Chair - Linux Foundation Open Printing WG
Secretary - IEEE-ISTO Printer Working Group
Co-Chair - IEEE-ISTO PWG Internet Printing Protocol WG
IETF Designated Expert - IPP & Printer MIB
Blue Roof Music / High North Inc
http://sites.google.com/site/blueroofmusic
http://sites.google.com/site/highnorthinc
mailto: [email-masked]
(permanent) PO Box 221  Grand Marais, MI 49839  906-494-2434
(to 30 April 2020) 203 W Oak St  Ellettsville, IN 47429  812-876-9970

On Tue, Feb 18, 2020 at 12:27 PM Haynes Jr., Dan <[email-masked]> wrote:

> Hi Everyone,
>
>
>
> Given the feedback from Ira and Roman, we would like to change the status
> of the document to “standards track” and get the document published as a
> “proposed standard”. Please let me know if you have any concerns about this
> change.
>
>
>
> Thanks,
>
> Danny
>
>
>
> *From: *sacm <[email-masked]> on behalf of Daniel Haynes <
> [email-masked]>
> *Date: *Thursday, February 6, 2020 at 11:49 AM
> *To: *Ira McDonald <[email-masked]>, "[email-masked]" <
> [email-masked]>
> *Subject: *Re: [sacm] [EXT] Fwd: EPCP and BCP Status
>
>
>
> I just wanted to follow up and see if anyone had thoughts on the status of
> the EPCP document given the discussion below.
>
>
>
> Thanks,
>
> Danny
>
>
>
> *From: *sacm <[email-masked]> on behalf of Ira McDonald <
> [email-masked]>
> *Date: *Friday, December 6, 2019 at 1:10 PM
> *To: *"[email-masked]" <[email-masked]>, Ira McDonald <
> [email-masked]>
> *Subject: *[EXT] [sacm] Fwd: EPCP and BCP Status
>
>
>
>
>
> Hi,
>
>
>
> From: *Ira McDonald* <[email-masked]>
> On Mon, Dec 2, 2019 at 12:44 PM Haynes Jr., Dan <[email-masked]> wrote:
>
> Hi Everyone,
>
> Sorry in advance for the long email, but Jess mentioned at IETF 106, it
> was asked whether or not EPCP should be a BCP or Informational draft. Given
> that, I tried to go back and dig up some information and here’s what I
> found :).
>
>
>
> Originally, EPCP was a Standards Track draft and in mid-2018, we changed
> its status to BCP (between -02 and -03). Also, around that time, there was
> a question on-list [1] as to whether or not it should be Standards Track or
> Informational where we re-iterated its BCP status.
>
>
>
> 1.      Is it going to be a Standard Track draft? Since I see you
> mentioned in the abstract it mainly describes the best practices, maybe an
> Informational draft is more suitable?
>
>
>
> [Danny]: I think I forgot to change that in the last draft, but, we would
> like to see this draft published as a BCP since it discusses the best
> practices for using IETF and TCG standards for endpoint assessment.
>
>
>
> In early 2019, we made further changes to the draft to better align it
> with the needs of a BCP draft (see attached slides).
>
>
>
> Unfortunately, I couldn’t find any concrete information as to why its
> status was changed to BCP, but, I want to say someone suggested it and as a
> group we thought it made sense at the time. Without that concrete
> information, we should look at BCP 9 [2] which states:
>
>
>
> Given this, I think it is fair to say that EPCP represents the best way to
> perform posture collection when the collector resides on the endpoint.
> Specifically, it outlines six best practices (see Section 2 of EPCP) as
> well as how you can implement those best practices using existing
> IETF/ISO/TCG standards.
>
>
>
> With all that said, does EPCP make sense as a BCP? Or, are there specific
> things that it is missing that make it a better candidate for an
> Informational draft?
>
>
>
> Thanks,
>
> Danny
>
>
>
> [email-masked]

---

From: "Haynes Jr., Dan" <[email-masked]>
Date: Tue, 25 Feb 2020 12:58:06 +0000

Thanks for the feedback Ira!

Given that I haven’t heard any other comments, I am going to go ahead and publish a new draft of EPCP with this status change and work to move the document into IESG review.

Please let me know if you have any comments or concerns.

Thanks,

Danny

From: Ira McDonald <[email-masked]>
Date: Tuesday, February 18, 2020 at 12:34 PM
To: Daniel Haynes <[email-masked]>, Ira McDonald <[email-masked]>
Cc: "[email-masked]" <[email-masked]>
Subject: Re: [sacm] [EXT] Fwd: EPCP and BCP Status

Hi Danny,

Cheers,
- Ira

mailto: [email-masked]<mailto:[email-masked]>

On Tue, Feb 18, 2020 at 12:27 PM Haynes Jr., Dan <[email-masked]<mailto:[email-masked]>> wrote:
Hi Everyone,

Thanks,

Danny

From: sacm <[email-masked]<mailto:[email-masked]>> on behalf of Daniel Haynes <[email-masked]<mailto:[email-masked]>>
Date: Thursday, February 6, 2020 at 11:49 AM
To: Ira McDonald <[email-masked]<mailto:[email-masked]>>, "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Subject: Re: [sacm] [EXT] Fwd: EPCP and BCP Status

Thanks,

Danny

From: sacm <[email-masked]<mailto:[email-masked]>> on behalf of Ira McDonald <[email-masked]<mailto:[email-masked]>>
Date: Friday, December 6, 2019 at 1:10 PM
To: "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>, Ira McDonald <[email-masked]<mailto:[email-masked]>>
Subject: [EXT] [sacm] Fwd: EPCP and BCP Status

Hi,

Cheers,
- Ira

---------- Forwarded message ---------
From: Ira McDonald <[email-masked]<mailto:[email-masked]>>
Date: Mon, Dec 2, 2019 at 1:35 PM
Subject: Re: [sacm] EPCP and BCP Status
Hi Danny,

Cheers,
- Ira

Thanks,

Danny

Thanks,

Danny