Last Call Review of draft-ietf-netmod-yang-usage-
review-ietf-netmod-yang-usage-secdir-lc-yu-2010-07-11-00

Request Review of draft-ietf-netmod-yang-usage
Requested rev. no specific revision (document currently at 11)
Type Last Call Review
Team Security Area Directorate (secdir)
Deadline 2010-07-08
Requested 2010-06-24
Other Reviews
Review State Completed
Reviewer Taylor Yu
Review review-ietf-netmod-yang-usage-secdir-lc-yu-2010-07-11
Posted at http://www.ietf.org/mail-archive/web/secdir/current/msg01849.html
Draft last updated 2010-07-11
Review completed: 2010-07-11

Review
review-ietf-netmod-yang-usage-secdir-lc-yu-2010-07-11

This document provides usage guidelines for the YANG data modeling
language so that standards track YANG data models will be more
readable and interoperable.

The Security Considerations section of this document states that it
does not introduce any new or increased risks to the management
system.  In fact, the document includes advice for consistently
communicating those risks in the context of YANG modules.

The Security Considerations section makes reference to a URL

    

http://www.ops.ietf.org/yang-security-considerations.txt



which had no content when I last visited it, so I was unable to review
it.

Section 3.4 lists the items whose security risks must be documented in
a conforming specification.  It omits the requirement, stated in Section
4.13, that potentially harmful operations must be mentioned in the
Security Considerations section of the conforming specification.
Section 3.4 should probably include the requirement from 4.13.

Editorial:

Is the use of "<CODE BEGINS>" in the example in Section 3.1 adequately
protected from tools that might interpret that string as beginning a
code component that is never completed?