Subject: [secdir] New boilerplate for reviews

From: Kathleen Moriarty <[email-masked]>
Date: Tue, 9 Dec 2014 13:52:39 -0500

Hello,

Stephen & I worked on an alternate boilerplate for reviews per request
from several ADs as editors are a bit confused with the current text.
They are not sure what to do with the reviews.  Ideally, we'd like
them to address your comments during last call and then Stephen & I
can pick up points that were not adequately addressed.

Here is a proposal for alternate text, let us know what you think:

I have reviewed this document as part of the security directorate's
ongoing effort to review all IETF documents being processed by the
IESG.  These comments were written with the intent of improving
security requirements and considerations in IETF drafts.  Comments
not addressed in last call may be included in AD reviews during the
IESG review.  Document editors and WG chairs should treat these
comments just like any other last call comments.

Thank you.

-- 

Best regards,
Kathleen

---

From: Leif Johansson <[email-masked]>
Date: Tue, 09 Dec 2014 19:55:24 +0100

> comments just like any other last call comments.

Reads a lot like the last one. Good :-)

	Cheers Leif

---

From: Melinda Shore <[email-masked]>
Date: Tue, 09 Dec 2014 17:02:35 -0900

> Here is a proposal for alternate text, let us know what you think:

Should we be construing this as a suggestion to minimize
comments on document issues not related to security?

Melinda

---

From: "Moriarty, Kathleen" <[email-masked]>
Date: Wed, 10 Dec 2014 02:59:40 +0000

Sent from my iPhone

> On Dec 9, 2014, at 9:02 PM, "Melinda Shore" <[email-masked]> wrote:
> 

Good question.  The change suggestion is a result of editor confusion when they receive a SecDir review.  They usually respond to the reviewer (treat it like any other last call comments), but some are not quite sure with the current mention of it being for the ADs.  Reviews are helpful whenever they come in, but if the comments have already been addressed in some way during the IETF last call, it makes it a lot easier in the IESG review.

If a reviewer is familiar with other parts of the work and has helpful comments & suggestions, please make them to help improve the draft.

Stephen suggested some alternate words to "improving the security requirements and considerations in IETF drafts" (intent is to capture that security comments may be anywhere in the draft and not limited to the security considerations).  The text would be: "improving the security and privacy properties of IETF specifications".

Thank you,
Kathleen
> 
> Melinda
> 
> _______________________________________________
> secdir mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/secdir
> wiki: http://tools.ietf.org/area/sec/trac/wiki/SecDirReview

---

From: Alexey Melnikov <[email-masked]>
Date: Wed, 10 Dec 2014 11:22:26 +0000

> comments just like any other last call comments.
I think this better reflects reality, so I am supportive of the new 
boilerplate.

---

From: Stephen Farrell <[email-masked]>
Date: Wed, 10 Dec 2014 12:39:18 +0000

On 10/12/14 02:59, Moriarty, Kathleen wrote:
> If a reviewer is familiar with other parts of the work and has
> helpful comments & suggestions, please make them to help improve the
> draft.

Right. Useful constructive comments should always be welcome
if you have them. If you can separate those out from security
or privacy issues that's nice, but mostly not needed since
reviews aren't usually very long.

And while we're on this, Kathleen and I asked Adrian Farrel
(RTG AD) if he'd come along to the secdir lunch next time and
give us his impressions of how secdir reviews are perceived
from the other side. Could be fun:-) And should be useful
since it was Adrian who was asking for a better boilerplate.

Cheers,
S.