Re: draft-jones-opsec-framework-01 comments

[Pekka Savola <pekkas@netcore.fi>]

On Tue, 9 Nov 2004, George Jones wrote:
> > In other words, an "ABC" on how to use this effectively for
> > operator/vendor dialogue, RFPs, or capability/feature documentation.
>
> This seems very reasonable/helpful.
>
> Do you think renaming "examples" something like "implementations"
> or "known implementations" would do it ?

If such a section would only describe the implementations we're 
comfortable recommending.

> For the sake of the clarity for implementors, we'd have to be sure to cite
> specific RFC/versions/etc where they exist.  How would you suggest dealing
> with things that may not be full sandard (e.g. ?NTP?, ?SSHv2?) or that
> have options (MAYs, SHOULDs) ?

There's really no help in the case when a stable specification does 
not exist.  Maybe referring to an internet-draft (if even such exists 
which is not guaranteed) is OK..

The options are indeed problematic, but too detailed to cover here; 
they should be discussed in the dialogue if needed.

--
Pekka Savola                 "You each name yourselves king, yet the
Netcore Oy                    kingdom bleeds."
Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings