Kathleen Moriarty's No Objection on draft-ietf-bmwg-issu-meth-01: (with COMMENT)

Kathleen Moriarty has entered the following ballot position for
draft-ietf-bmwg-issu-meth-01: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)


Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.


The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-bmwg-issu-meth/



----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

In section 3, when "other checks" are described, I'd like to see an
explicit mention of a check to ensure the device is authorized to install
the software/firmware.  There have been numerous attacks against just
about every vendor where counterfeit hardware is deployed and runs the
firmware, OS, etc. issued.  Fraud can be a big issue and it isn't always
talked about, but this should definitely be a security consideration.  I
do think it fits in the subsections of section 3.  The statement added
can be as simple as, "check performed to ensure the device is authorized
to install the firmware".