Re: draft-jones-opsec-framework-01 comments

[George Jones <eludom@gmail.com>]

On Tue, 9 Nov 2004 20:43:19 +0200 (EET), Pekka Savola <pekkas@netcore.fi> 
> 
> Sorry for being unclear.  I think I tried to propose a "procedural"
> approach to this problem:
> 
>   1) have an explicit subsection of known techniques under each
> capability (whether Examples is good enough or not can be considered).
> (So that good technologies, known as of the time of the writing, are
> consistently listed in a concise format for each technology.)
> 
>   2) state that the vendors who advertise that they implement
> capability X should always also describe which technologies they use
> to implement X.
> 
>   3) state that the operators who require certain capability X
> could/should also additionally describe which technologies for X they
> would find most appropriate.
> 
> In other words, an "ABC on how to use this effectively for
> operator/vendor dialogue, RFPs, or capability/feature documentation.

This seems very reasonable/helpful.

Do you think renaming "examples" something like "implementations"
or "known implementations" would do it ?

For the sake of the clarity for implementors, we'd have to be sure to cite
specific RFC/versions/etc where they exist.  How would you suggest dealing
with things that may not be full sandard (e.g. ?NTP?, ?SSHv2?) or that
have options (MAYs, SHOULDs) ?

In the end, I think this is all going to be a guide for consructive dialogue.

---George