Subject: [secdir] secdir review of draft-richardson-roll-applicability-template-01

From: "Dan Harkins" <[email-masked]>
Date: Wed, 20 Feb 2013 14:31:53 -0800 (PST)

Hello,

  I have reviewed this document as part of the security directorate's
ongoing effort to review all IETF documents being processed by the
IESG.  These comments were written primarily for the benefit of the
security area directors.  Document editors and WG chairs should treat
these comments just like any other last call comments.

  Boilerplate aside, I hope that this document is not being processed
by the IESG because I don't think it's suitable for publishing even as
an Informational RFC (it's intended status). It seems to have the right
sections to properly articulate the ROLL Applicability Statement but
there is no content there so it is not suitable for any purpose as a
stand-alone document and it's not really possible to review it. This
seems more like an internal placeholder document for the ROLL WG
to work on as a precursor to producing a real applicability statement
and not the kind of document that the IETF normally produces, and
that the Security Area Directorate normally reviews.

  Some suggestions for improving this template so some other
draft that would be suitable for advancement could be written:

  - Instead of "Hello", I think the content of "1. Introduction"
     should be a description of what the applicability statement
     will be and what it's for, that way this text can just be copied
     into the real applicability statement. It seems like a template
     should provide this information.
  - Make a 1.2 for terminology and put "RPL" and "trickle" there
     along with some other ROLL-related terms.
  - there are probably different security considerations for P2P
     and P2MP communication, probably split those out in
     section 6 so the applicability statement addresses them.
  - 4.2.1 should be "Services Provided at Layer 2" or something
     general like that. If you need an expert that might be better
     noted as a parenthetical comment for 4.2.

  regards,

  Dan.

---

From: Michael Richardson <[email-masked]>
Date: Wed, 20 Feb 2013 23:24:45 -0500

Dan, thanks for the work.

>>>>> "Dan" == Dan Harkins <[email-masked]> writes:
    Dan> Boilerplate aside, I hope that this document is not being processed
    Dan> by the IESG because I don't think it's suitable for publishing even as
    Dan> an Informational RFC (it's intended status). It seems to have the right
    Dan> sections to properly articulate the ROLL Applicability Statement but
    Dan> there is no content there so it is not suitable for any purpose
    Dan> as a

*THIS* document is not intended to be published.  It remains an ID to be
copied.  I would have hoped the context for this advance review would
have been communicated better....

The idea is that current and future Applicability statements will use
the table of contents provided.   So, before secdir is asked to review
the security implications of a "real" document, we want to figure out
what major sections might be *missing* from the table of contents.

So I will attempt to fill in the Introduction with an actual
Introduction to explain this document.

Here are two example applicability statements which we are trying to get
into this format.  

http://datatracker.ietf.org/doc/draft-brandt-roll-rpl-applicability-home-building/
http://datatracker.ietf.org/doc/draft-phinney-roll-rpl-industrial-applicability/

If I have my way, many of these documents will be further reduced in
scope, resulting in many more than our originally chartered four such
documents.

-- 
]               Never tell me the odds!                 | ipv6 mesh networks [ 
]   Michael Richardson, Sandelman Software Works        | network architect  [ 
]     [email-masked]  http://www.sandelman.ca/        |   ruby on rails    [