Subject: Re: [savi] WG Last Call for SAVI Threat Scope Document

From: Joel Halpern <[email-masked]>
Date: Tue, 09 Nov 2010 04:43:28 -0500

Resend as requested by chairs:
-------------------------------------------

Sorry for the delay in responding to this.
The major content of Pekka's review, retained below, is to remove a 
number of sections from the document.

I am happy to remove the text as he suggests.  But given the scope, I 
need concurrence from the WG, as judged by the chairs, for this scope of 
change.

Do folks want the text removed, or retained?

Thank you,
Joel

On 10/5/2010 7:54 AM, Pekka Savola wrote:
...
> ..............
>
> First, I understand that this document is expected to cover the
> following charter item:
>
> For background information, the working group will also develop a
> threats analysis document that describes what threats the solutions
> from the WG protect against. This document also contrasts SAVI
> to existing solutions.
>
> .. the draft does fill this gap, after a fashion. It also includes a lot
> of other material. My interpretation is that the aim of the document is
> to provide a threats analysis from SAVI WG perspective (where the main
> focus is the "same link solutions" as specified in the charter).
>
> As a consequence, I think the main body of S 6 (except S 6.1) is not
> specific to this document and is rather generic. Similarly, S 7 in
> almost all of its entirety is rather generic and lacks SAVI specificity.
> S 8 could also be removed without major loss of content, or
> rephrased/summarized. A half of Security considerations is not really
> from SAVI WG problem perspective.

...

---

From: Joel Halpern <[email-masked]>
Date: Tue, 09 Nov 2010 04:46:16 -0500

Resend as requested by chairs, with a note.
Below is one note from the thread about the threats table and the 
quesiton of which threats we are supposed to cover.
My current understanding is that we are supposed to cover the threats 
that Savi is trying to address, that exist before SAVI.  The threats 
document is NOT the security considerations section for the collection 
of SAVI solutions.  If we want to change that view, please tell me.
Also, in this thread, we  discussed the relevance of BCP 38.  Please 
review the thread in the archive.

Thank you,
Joel

----------------------

While I like the idea of a table of threats and coverage such as Pekka 
describes below, I am concerned that it is not practical.  The threats 
document can not mandate what solutions SAVI will actually provide, how 
they will work, or what deployments they will actually be used in.  I 
would like to keep the threats document focused on describing the 
SAVI-relevant threats that exist before SAVI is deployed, and not try to 
describe what SAVI will do.

I would like opinions from the rest of the WG as to whether this 
constitues an acceptable response to this request?

Thank you,
Joel

> I found still looking for clear text, a table or something that would
> describe "so, what exactly are the residual threats after various SAVI
> solutions?" and "what else needs to be deployed in addition to SAVI
> solutions?". I did not find an explicit contrasting to existing solutions.
...

---

From: Christian Vogt <[email-masked]>
Date: Tue, 9 Nov 2010 15:31:38 -0500

Joel Halpern wrote:

> The major content of Pekka's review, retained below, is to remove a number of sections from the document.
> 
> I am happy to remove the text as he suggests.  But given the scope, I need concurrence from the WG, as judged by the chairs, for this scope of change.
> 

Working group:

I reiterate that your feedback is necessary here for the working group to move forward.  Please read the SAVI Threat Scope document, read the review of Pekka Savola, and comment on this mailing list on whether you concur with the changes suggested by Pekka, or whether you would prefer a different way forward.

Please do so by Friday, November 26, 2010.  We will then make a decision.

- Jean-Michel and Christian

---

From: "Bi Jun" <[email-masked]>
Date: Wed, 24 Nov 2010 18:05:24 +0800

After reading those comments, I think maybe the WG needs a "problem 
statement" draft (like many other WG has such a problem statement document), 
which mainly foucus on threats in access network, related existing 
anti-spoofing solutions in access network and why they don't work well, and 
clearly state the problem to be resolved in access network.

Thanks,
Jun Bi

-----原始邮件----- 
From: Joel Halpern
Sent: Tuesday, November 09, 2010 5:46 PM
To: SAVI Mailing List
Subject: Re: [savi] Threats review table suggestion

Thank you,
Joel

----------------------

Thank you,
Joel

> solutions?". I did not find an explicit contrasting to existing solutions.
...
_______________________________________________
savi mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/savi