Re: draft-jones-opsec-01.txt comments: in-band management

[ericb@digitaljunkyard.net]

 "gj" == George Jones <gmj@pobox.com> writes:

>> Terminal, yes.  What if the device in question is a Cisco VOIP call
>> manager running on a Cisco that's really an HP that's really a Compaq
>> running Win2k?  You need a GUI, and forwarding MS Windows over ssh
>> doesn't quite work correctly yet.

gj> In that particular case, it would violate the "must be scriptable"
gj> requirement, "must work over low bandwith", and possibly the
gj> the "must be able to use a CLI over RS232" reqs (still under discussion).

OK, but there's no reason the device should not be able to comply with
the remainder of the requirements.

gj> If it is acceptable to the customer require someone to be onsite,
gj> Windows-install and patch CDs in hand, and to have to be standing
gj> in front of the GUI console of each device to patch them one-by-one
gj> in a non-scripted fashion, then the customer is free to say to the
gj> vendor "my reqs are everything in the BCP MINUS x,y and z".

gj> That's the intellegent approach.

Exactly.

gj> The other approach is the "I don't want to think about it and I'm
gj> willing to buy all the assumptions in the BCP, so just implement
gj> everything in the BCP and I'll treat the entire BCP as a single
gj> checkbox" approach.

gj> That's the "don't make me think approach."

Which is honestly what we're trying to discourage.  Hence the
Justifications section.  "This is why you want this feature".

If you're gonna hook something up to the Internet and expect to make
money off it, you SHOULD think about it.

ericb