Subject: [Dots] Grammar/Wording Comments on draft-ietf-dots-requirements-04

From: "Russ White" <[email-masked]>
Date: Mon, 29 May 2017 20:44:41 -0400

Y'all --

I've (finally) read through the requirements draft; I'll hopefully be reading through all the docs over the next week or so. This email contains my grammar/wording comments; the next will have more substantial questions/comments.

😊 /r

==
attacks continue to plague networks around the globe

while the network is impacted, it is the operator who is targeted (really) -- this feels like it should say "network operators"

==
expertise to operate on-premise

should be "expertise to operate on-premises" 

==
characteristics of a DOTS protocol

"DOTS" isn't needed in this sentence.

==
tying subscribers to proprietary implementations

Implementations of... ?? I think you mean here proprietary signaling software provided by the security services provider (?), but I'm not certain this is correct. 

==
As a result of incompatibility across services, attack responses may be fragmentary or otherwise

I think you mean interface or signaling incompability; I don't think you mean the services are incompatible (I'm not certain what "compatible services" would mean, actually).

==
The lack of a common method to coordinate a real-time response among involved actors and network domains

This seems like the second reason of two -- but the text doesn't seem to separate the two different reasons here other than placing them into separate paragraphs. It might be useful to actually say "the first reason for such a protocol is... the second reason for such a protocol is..." or somehow indicate there are two separate reasons here.

==
the DOTS client need not be present before establishing DOTS communication between DOTS agents

This might be cleaner if it said "before establishing a communication channel..." rather than putting DOTS in the sentence three times...

==
DOTS must at a minimum make it possible for a DOTS client to request a DOTS server’s aid in mounting a coordinated defense against a suspected attack,

I think this means the DOTS protocol, not DOTS itself. Further, the client is not requesting the server's aid, but the mitigator's request; the server is a logical intermediary, really, so maybe this should read "for a DOTS client to request a mitigator's aid in mounting a defense coordinated by a server (or set of servers)..." or something like that?

==
Regular feedback between DOTS clients and DOTS server supplement the defensive alliance by maintaining a common understanding of DOTS peer health and activity. Bidirectional communication between DOTS clients and DOTS servers is therefore critical.

First -- it "feels like" this is the start of a new thought, and hence a new paragraph should begin here. Perhaps it should be in the same paragraph with the following sentence, which seems to be a part of the same thought, with a new paragraph starting at "On the one hand..." just after the following sentence.

Second -- "DOTS peer" has not been used before in the document; should this be "DOTS agent," just to keep the language consistent? 

==
Yet DOTS must also work with a set of competing operational goals.

Might be better reworded a little -- something like "DOTS protocol implementations face competing operational goals in maintaining this bidirectional communication stream."

==
for DOTS to operate safely,

This seems a little underspecified -- what, precisely, does "operate safely" mean? I think the primary concern here must be to prevent opening a new attack surface, in which unauthenticated DOTS mitigation requests are sent as a form of, or part of a larger, attack. If this is so, then perhaps adding some text like --

DOTS clients must be able to authenticate DOTS servers, and vice versa, for the deployment of DOTS not to create new attack surfaces; specifically, for DOTS signaling not to be used to trigger a DDoS mitigation response as a new form of attack. In order to provide this level of protection, DOTS agents MUST negotiate and agree upon the terms of protocol security.

But this might be better with a little more work...

==
Finally, DOTS should provide sufficient extensibility to meet local, vendor or future needs in coordinated attack defense, although this consideration is necessarily superseded by the other operational requirements.

A bit overspecified, I think. Maybe just --

Finally, DOTS signaling should be sufficiently extensible to meet future defense coordination needs (although this...)

==
OP-003

it is RECOMMENDED DOTS servers avoid redirecting while mitigation is

I think I'd reword this to "DOTS servers SHOULD NOT redirect while mitigation..." to fall into a "more standard" wording pattern.