Subject: [yang-doctors] Fwd: Re: [netmod] YANG module security considerations template - TLS reference

From: Lou Berger <[email-masked]>
Date: Fri, 5 Oct 2018 08:25:54 -0400

Hi,

     To close on this, I propose that we manage the page as follows:

1) YANG Doctors agree that update is required

2) One YANG DR sends the proposed changes to the netmod WG and shepherds 
any discussion

3)  If discussion yields changes, YANG DR sends final text to netmod WG

4) One NetMod WG chair declares WG consensus on text and updates wiki 
(or identifies who should update wiki, e.g., YANG DR).

Note this also means that the wiki moves out from under ops/wiki to 
netmod/wiki and that the page should be updated to document this process 
once agreed to.

Does this make sense to everyone?  Any objections? ADs any comments?

Lou

-------- Forwarded Message --------
Subject: 	Re: [netmod] YANG module security considerations template - 
TLS reference
Resent-Date: 	Mon, 1 Oct 2018 11:58:16 -0700 (PDT)
Resent-From: 	[email-masked]
Resent-To: 	[email-masked], [email-masked], [email-masked], 
[email-masked]
Date: 	Mon, 1 Oct 2018 18:58:11 +0000
From: 	Acee Lindem (acee) <[email-masked]>
To: 	Lou Berger <[email-masked]>, Kent Watsen <[email-masked]>, 
Martin Bjorklund <[email-masked]>, [email-masked] 
<[email-masked]>, [email-masked] <[email-masked]>, 
[email-masked] <[email-masked]>

Agreed. I think we should have a couple designated experts (similar to what we have with IANA registries) that would have editorial authority and could field suggestions for updates (e.g., for example from the Security ADs).

Thanks,
Acee

On 10/1/18, 2:50 PM, "Lou Berger" <[email-masked]> wrote:

     At this point I think it's mature enough to be a yang DR or NETMOD wg thing?
     
     Thoughts, objections?
     
     Lou

     ----------
     On October 1, 2018 2:32:34 PM Kent Watsen <[email-masked]> wrote:
     
     > Benoit is the progenitor of the template.  I took it to be an "AD thing"
     > has since passed to Ignas.
     >
     > Kent
     >
     >
     >
     > ?-----Original Message-----
     > From: "Acee Lindem (acee)" <[email-masked]>
     > Date: Monday, October 1, 2018 at 10:25 AM
     > To: Martin Bjorklund <[email-masked]>, "[email-masked]"
     > <[email-masked]>, "[email-masked]" <[email-masked]>,
     > "[email-masked]" <[email-masked]>
     > Subject: Re: [netmod] YANG module security considerations template - TLS
     > reference
     > Resent-From: <[email-masked]>
     > Resent-To: <[email-masked]>, <[email-masked]>, <[email-masked]>,
     > <[email-masked]>
     > Resent-Date: Monday, October 1, 2018 at 10:25 AM
     >
     > Agreed - although I'm not sure who has control over the template either.
     >
     > For drafts that are in-progress, IDNITs will flag this obsolete reference
     > and, for at least one of the drafts I'm an editor, I've already made the
     > update.
     >
     > Thanks,
     > Acee
     >
     > On 10/1/18, 3:19 AM, "netmod on behalf of Martin Bjorklund"
     > <[email-masked] on behalf of [email-masked]> wrote:
     >
     >     Hi,
     >
     >     In their review of draft-ietf-netconf-nmda-restconf, the IESG
     >     suggested we update the reference to TLS from RFC 5246 to RFC 8446
     >     (which obsoletes 5246).
     >
     >     This update needs to be done to the template available at
     >     https://urldefense.proofpoint.com/v2/url?u=https-3A__trac.ietf.org_trac_ops_wiki_yang-2Dsecurity-2Dguidelines&d=DwIGaQ&c=HAkYuh63rsuhr6Scbfh0UjBXeMK-ndb3voDTXcWzoCI&r=9zkP0xnJUvZGJ9EPoOH7Yhqn2gsBYaGTvjISlaJdcZo&m=54lt0_rCJTvXEIWmFXsdUNDbzJIkrJ86K-IveL1QoG4&s=9uZWNJN6weNKKk7ABnZ-yFVkwdZxZzQOSm9bSXwT1SQ&e=
     >
     >     (it is not quite clear who is repsonsible for this template; maybe
     >     that should be clarified on the page)
     >
     >
     >     /martin
     >
     >     _______________________________________________
     >     netmod mailing list
     >     [email-masked]
     >     https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_netmod&d=DwIGaQ&c=HAkYuh63rsuhr6Scbfh0UjBXeMK-ndb3voDTXcWzoCI&r=9zkP0xnJUvZGJ9EPoOH7Yhqn2gsBYaGTvjISlaJdcZo&m=54lt0_rCJTvXEIWmFXsdUNDbzJIkrJ86K-IveL1QoG4&s=QhZGZPVsGhr3-uPQZRPyHFcBYz59K2QZxenbb7Ly7L8&e=
     >
     >
     >
     > _______________________________________________
     > netmod mailing list
     > [email-masked]
     > https://www.ietf.org/mailman/listinfo/netmod

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Fri, 5 Oct 2018 15:55:43 +0200

On Fri, Oct 05, 2018 at 08:25:54AM -0400, Lou Berger wrote:
> 2) One YANG DR sends the proposed changes to the netmod WG and shepherds any
> discussion
> 
> 4) One NetMod WG chair declares WG consensus on text and updates wiki (or
> identifies who should update wiki, e.g., YANG DR).
> 

In the past, YANG doctors did their work in order to help their
AD. First sentence on https://datatracker.ietf.org/group/yangdoctors/about/

  The YANG doctors/reviewers are supposed to help the OPS AD
  responsible for Network Management to review YANG documents that are
  destined to be on the IESG agenda.

Are we not on the way to move the YANG doctors work into a WG
activity? If so, I think this is wrong. We have always been very clear
that YANG doctor reviews are _not_ provided as a service of the NETMOD
WG to other WGs.

/js

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: +49 421 200 3587         Campus Ring 1 | 28759 Bremen | Germany
Fax:   +49 421 200 3103         <https://www.jacobs-university.de/>

---

From: Lou Berger <[email-masked]>
Date: Fri, 5 Oct 2018 10:17:30 -0400

>    destined to be on the IESG agenda.
Sure.  And the next sentence reads:

     The YANG doctors/reviewers can also act as NETCONF/YANG advisors to 
WGs
     in any area of the IETF. Such is normally arranged between the WG 
chairs and
     the responsible ADs.

> activity?
no!  But I am saying that the security guidelines are sufficiently 
mature that they can be managed by the NetMod WG, under the advice of 
the YANG Drs, rather than take up AD time. And I'm trying to "arrange" 
this now.

Lou

> If so, I think this is wrong. We have always been very clear

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Fri, 5 Oct 2018 16:22:53 +0200

On Fri, Oct 05, 2018 at 10:17:30AM -0400, Lou Berger wrote:
> 
> no!  But I am saying that the security guidelines are sufficiently mature
> that they can be managed by the NetMod WG, under the advice of the YANG Drs,
> rather than take up AD time. And I'm trying to "arrange" this now.
>

If it does not take much time, what is the rationale to offload this
task from the AD? I fail to see the point of this exercise.

/js

---

From: Lou Berger <[email-masked]>
Date: Fri, 5 Oct 2018 12:40:48 -0400

On 10/5/2018 10:22 AM, Juergen Schoenwaelder wrote:
> task from the AD?

Yes - the update hasn't yet happened, and the ADs are free to object to 
the proposed change.

> I fail to see the point of this exercise.
That's fair.  *but* can you live with the change?

Lou

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Fri, 5 Oct 2018 23:25:34 +0200

> That's fair.  *but* can you live with the change?

I want to see a convincing reason for the change. Without a reason, I
object to the change. The yang-doctors activity or the maintenance of
security guidelines text is not a WG task and hence not the task of WG
chairs.

/js

---

From: Lou Berger <[email-masked]>
Date: Fri, 5 Oct 2018 17:59:37 -0400

Juergen,

I've asked the ADs to chime in.  FWIW I'm happy either way as long as 
the wiki is under the active care of someone - even the WG without input 
from the YANG Drs.

Lou

---

From: Warren Kumari <[email-masked]>
Date: Mon, 8 Oct 2018 19:54:39 -0400

[ + Benoit, as he's made many of the edits ]

> the wiki is under the active care of someone - even the WG without input

This is really not my area (it's Ignas') and I know nothing about it, but I
was asked to chime in, so I will :-)

Reminding people that I don't know the history of this, it seems reasonable
that minor editorial edits (like acronyms, etc) be done by whoever seems
willing (with a note dropped to the AD), but more substantive changes
(like RFC 5246 -> RFC 8446) be done by the AD (editing a wiki is a trivial
thing). Some of this was driven by the fact that the page has something
like a page history at the top.

Looking at
https://trac.ietf.org/trac/ops/wiki/yang-security-guidelines?action=history,
all of the changes were made by Dan and Benoit, other than a single change
where Mahesh expanded an acronym.
Benoit made this change 3 months ago:
https://trac.ietf.org/trac/ops/wiki/yang-security-guidelines?action=diff&version=16&old_version=15

Adam Roach's ballot comment was:
"Unless this mechanism relies on some behavior that is different between
TLS 1.2
and TLS 1.3, please update this reference to RFC 8446."

I do not know of any reliance on behavior that is different between TLS 1.2
and TLS 1.3 (see disclaimers above) I've just gone ahead and made the
changes.

Please please please, if anyone knows of a reason why this won't work, let
me know and I'll roll it back...

W

> yang-doctors mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/yang-doctors
>

-- 
I don't think the execution is relevant when it was obviously a bad idea in
the first place.
This is like putting rabid weasels in your pants, and later expressing
regret at having chosen those particular rabid weasels and that pair of
pants.
   ---maf

---

From: Lou Berger <[email-masked]>
Date: Tue, 09 Oct 2018 06:34:09 -0400

Hi Warren,

Thanks for making the change and for letting us know that it's acceptable 
(for basically anyone, e.g. yang Drs or a wg) to make minor changes that 
are then run by the ads.

Lou

----------