Re: draft-ietf-v6ops-cpe-simple-security-06

[Brian E Carpenter <brian.e.carpenter@gmail.com>]

Hi James,

On 2009-06-28 17:43, james woodyatt wrote:
...

> All that said, however, I don't see how any "lower level of security"
> than described here is compatible with the level recommended in RFC
> 4864, which was the starting point for this work.  If we're going to
> diverge from that baseline, then I'd expect that work would have to be
> the subject of an rfc4864bis draft, or at least a draft marked as an
> Update to RFC 4864, which this draft is most definitely not.  At least,
> not yet.
> 
> Shorter james: I have no technical objection to the proposal, but my
> editorial judgment is that it isn't appropriate to make it an amendment
> to this draft.

4864 is Informational and this draft is currently tagged with
Intended status: Informational, so we don't have to be legalistic
about requirements. I think this issue could be resolved
by adding to this sentence in the Introduction:

>    In particular, extra care should be taken in designing the baseline
>    operating modes of unconfigured devices, since the security functions
>    of most devices will never be changed from their factory set default.

For example

   The designers of such devices should nevertheless provide user settable
   options for users who wish to increase or decrease the level of
   protection.

       Brian