This is a purely informative rendering of an RFC that includes verified errata. This rendering may not be used as a reference.

The following 'Verified' errata have been incorporated in this document: EID 8036


Internet Engineering Task Force (IETF)                        R. Danyliw
Request for Comments: 9141                Software Engineering Institute
Updates: 2077, 2418, 2648, 2954, 2955, 3020,               November 2021
         3083, 3201, 3202, 3295, 3684, 3962,
         3970, 4036, 4131, 4251, 4323, 4546,
         4547, 4639, 4682, 5098, 5428, 6756,
         7241
Category: Standards Track
ISSN: 2070-1721

              Updating References to the IETF FTP Service

Abstract

   The IETF FTP service running at ftp.ietf.org, ops.ietf.org, and
   ietf.org will be retired.  A number of published RFCs in the IETF and
   IAB streams include URIs that reference this FTP service.  To ensure
   that the materials referenced using the IETF FTP service can still be
   found, this document updates the FTP-based references in these
   affected documents with HTTPS URIs.

Status of This Memo

   This is an Internet Standards Track document.

   This document is a product of the Internet Engineering Task Force
   (IETF).  It represents the consensus of the IETF community.  It has
   received public review and has been approved for publication by the
   Internet Engineering Steering Group (IESG).  Further information on
   Internet Standards is available in Section 2 of RFC 7841.

   Information about the current status of this document, any errata,
   and how to provide feedback on it may be obtained at
   https://www.rfc-editor.org/info/rfc9141.

Copyright Notice

   Copyright (c) 2021 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents
   (https://trustee.ietf.org/license-info) in effect on the date of
   publication of this document.  Please review these documents
   carefully, as they describe your rights and restrictions with respect
   to this document.  Code Components extracted from this document must
   include Revised BSD License text as described in Section 4.e of the
   Trust Legal Provisions and are provided without warranty as described
   in the Revised BSD License.

Table of Contents

   1.  Introduction
   2.  Conventions and Definitions
   3.  Updated References
     3.1.  RFC 2077
     3.2.  RFC 2418
     3.3.  RFC 2648
     3.4.  RFC 2954
     3.5.  RFC 2955
     3.6.  RFC 3020
     3.7.  RFC 3083
     3.8.  RFC 3201
     3.9.  RFC 3202
     3.10. RFC 3295
     3.11. RFC 3684
     3.12. RFC 3962
     3.13. RFC 3970
     3.14. RFC 4036
     3.15. RFC 4131
     3.16. RFC 4251
     3.17. RFC 4323
     3.18. RFC 4546
     3.19. RFC 4547
     3.20. RFC 4639
     3.21. RFC 4682
     3.22. RFC 5098
     3.23. RFC 5428
     3.24. RFC 6756
     3.25. RFC 7241
     3.26. Generic Guidance
   4.  Security Considerations
   5.  IANA Considerations
   6.  References
     6.1.  Normative References
     6.2.  Informative References
   Acknowledgments
   Author's Address

1.  Introduction

   After community consultation in late 2020, it was decided to retire
   the IETF FTP service running at ftp.ietf.org, ops.ietf.org, and
   ietf.org [FTP-RETIREMENT].  Appendix B of [FTP-RETIREMENT-PLAN]
   identifies 30 RFCs published in the IETF and IAB streams between
   1997-2006 that have at least one explicit or inline reference to a
   URI pointing to the IETF FTP service.  To ensure that the materials
   referenced using the IETF FTP service can still be found, this
   document formally updates those RFCs that had not been updated by
   other documents with HTTPS URIs to the same materials.

   Section 3 enumerates each of the affected RFCs and provides
   replacement text.

2.  Conventions and Definitions

   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
   "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and
   "OPTIONAL" in this document are to be interpreted as described in
   BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all
   capitals, as shown here.

   The original text from an RFC to be updated will be quoted with
   "OLD", and the replacement text will be quoted with "NEW".

3.  Updated References

   This document updates the following RFCs.

   [RFC2077] [RFC2418] [RFC2648] [RFC2954] [RFC2955] [RFC3020] [RFC3083]
   [RFC3201] [RFC3202] [RFC3295] [RFC3684] [RFC3962] [RFC3970] [RFC4036]
   [RFC4131] [RFC4251] [RFC4323] [RFC4546] [RFC4547] [RFC4639] [RFC4682]
   [RFC5098] [RFC5428]

   Additionally, with permission of the IAB, [RFC6756] and [RFC7241] are
   also updated.

3.1.  RFC 2077

   Section 3 of [RFC2077] is updated as follows:

   OLD:

   |  Copies of RFCs are available on:
   |
   |     ftp://ftp.isi.edu/in-notes/
   |
   |  Copies of Internet-Drafts are available on:
   |
   |     ftp://ftp.ietf.org/internet-drafts/

   NEW:

   |  Copies of RFCs are available on:
   |
   |     https://www.rfc-editor.org/rfc/
   |
   |  Copies of Internet-Drafts are available on:
   |
   |     https://www.ietf.org/id/

3.2.  RFC 2418

EID 8036 (Verified) is as follows:

Section: 3.2

Original Text:

NEW:

Those archives are located
 at https://www.ietf.org/ietf-ftp/ietf-⁠mail-archive/.

Corrected Text:

NEW:

Those archives are located
 at https://www.ietf.org/ietf-ftp/ietf-mail-archive/.
Notes:
There's a word joiner (WJ) (U+2060) between "ietf-" and "mail-archive/" in the URL which translates to https://www.ietf.org/ietf-ftp/ietf-%E2%81%A0mail-archive/
Section 2.2 of [RFC2418] is updated as follows: OLD: | Those archives are located at ftp://ftp.ietf.org/ietf-mail- | archive. NEW: | Those archives are located at https://www.ietf.org/ietf-ftp/ietf- | mail-archive/. 3.3. RFC 2648 Section 2 of [RFC2648] is updated below. Note that the scripts in Appendix A have not been updated. OLD: | The list of minutes maintained by the IETF for each working group | and conference in the subtree pointed at by the URL | ftp://ietf.org/ietf/ is considered the definitive assignment of | URNs for working group or birds of a feather minutes. NEW: | The list of minutes maintained by the IETF for each working group | and conference in the subtree pointed at by the URL | https://www.ietf.org/how/meetings/proceedings/ is considered the | definitive assignment of URNs for working group or birds of a | feather minutes. 3.4. RFC 2954 The CONTACT-INFO in the MIB in Section 3 of [RFC2954] contains an outdated email archive reference. The revised reference is as follows: OLD: | Email Archive: | | ftp://ftp.ietf.org/ietf-mail-archive/frnetmib NEW: | Email Archive: | | https://www.ietf.org/ietf-ftp/ietf-mail-archive/frnetmib/ 3.5. RFC 2955 The CONTACT-INFO in the MIB in Section 4 of [RFC2955] contains an outdated email archive reference. The revised reference is as follows: OLD: | Email Archive: | | ftp://ftp.ietf.org/ietf-mail-archive/frnetmib NEW: | Email Archive: | | https://www.ietf.org/ietf-ftp/ietf-mail-archive/frnetmib/ 3.6. RFC 3020 The CONTACT-INFO in the MIB in Section 3 of [RFC3020] contains an outdated email archive reference. The revised reference is as follows: OLD: | Email Archive: ftp://ftp.ietf.org/ietf-mail-archive/frnetmib NEW: | Email Archive: https://www.ietf.org/ietf-ftp/ietf-mail-archive/ | frnetmib/ 3.7. RFC 3083 The CONTACT-INFO in the MIB in Section 4 of [RFC3083] contains an outdated email archive reference. The revised reference is as follows: OLD: | Archive: ftp://ftp.ietf.org/ietf-mail-archive/ipcdn NEW: | Archive: https://www.ietf.org/ietf-ftp/ietf-mail-archive/ipcdn/ 3.8. RFC 3201 The CONTACT-INFO in the MIB in Section 6 of [RFC3201] contains an outdated email archive reference. The revised reference is as follows: OLD: | Email Archive: ftp://ftp.ietf.org/ietf-mail-archive/frnetmib NEW: | Email Archive: https://www.ietf.org/ietf-ftp/ietf-mail-archive/ | frnetmib/ 3.9. RFC 3202 The CONTACT-INFO in the MIB in Section 7 of [RFC3202] contains an outdated email archive reference. The revised reference is as follows: OLD: | Email Archive: ftp://ftp.ietf.org/ietf-mail-archive/frnetmib NEW: | Email Archive: https://www.ietf.org/ietf-ftp/ietf-mail-archive/ | frnetmib/ 3.10. RFC 3295 The CONTACT-INFO in the MIB in Section 4 of [RFC3295] contains an outdated email archive reference. The revised reference is as follows: OLD: | Email Archive: | | ftp://ftp.ietf.org/ietf-mail-archive/gsmp/ NEW: | Email Archive: | | https://www.ietf.org/ietf-ftp/ietf-mail-archive/gsmp/ 3.11. RFC 3684 Two informative references in Section 14.2 of [RFC3684] are updated as follows: OLD: | [7] Ogier, R., Message in IETF email archive for MANET, | ftp://ftp.ietf.org/ietf-mail-archive/manet/2002-02.mail, February | 2002. NEW: | [7] Ogier, R., Message in IETF email archive for MANET, | https://www.ietf.org/ietf-ftp/ietf-mail-archive/ | manet/2002-02.mail, February 2002. OLD: | [9] Ogier, R., Message in IETF email archive for MANET, | ftp://ftp.ietf.org/ietf-mail-archive/manet/2002-03.mail, March | 2002. NEW: | [9] Ogier, R., Message in IETF email archive for MANET, | https://www.ietf.org/ietf-ftp/ietf-mail-archive/ | manet/2002-03.mail, March 2002. 3.12. RFC 3962 An informative reference in [RFC3962] is updated as follows: OLD: | [LEACH] Leach, P., email to IETF Kerberos working group mailing | list, 5 May 2003, ftp://ftp.ietf.org/ietf-mail-archive/krb- | wg/2003-05.mail. NEW: | [LEACH] Leach, P., email to IETF Kerberos working group mailing | list, 5 May 2003, https://www.ietf.org/ietf-ftp/ietf-mail-archive/ | krb-wg/2003-05.mail. 3.13. RFC 3970 The CONTACT-INFO in the MIB in Section 5 of [RFC3970] contains an outdated email archive reference. The revised reference is as follows: OLD: | Archive: ftp://ops.ietf.org/pub/lists NEW: | Archive: https://www.ietf.org/ietf-ftp/concluded-wg-ietf-mail- | archive/tewg/ 3.14. RFC 4036 The CONTACT-INFO in the MIB in Section 4 of [RFC4036] contains an outdated email archive reference. The revised reference is as follows: OLD: | Archive: ftp://ftp.ietf.org/ietf-mail-archive/ipcdn NEW: | Archive: https://www.ietf.org/ietf-ftp/ietf-mail-archive/ipcdn/ 3.15. RFC 4131 The CONTACT-INFO in the MIB in Section 3 of [RFC4131] contains an outdated email archive reference. The revised reference is as follows: OLD: | Archive: ftp://ftp.ietf.org/ietf-mail-archive/ipcdn. NEW: | Archive: https://www.ietf.org/ietf-ftp/ietf-mail-archive/ipcdn/. 3.16. RFC 4251 An informative reference in [RFC4251] is updated as follows: OLD: | [DAI] Dai, W., "An attack against SSH2 protocol", Email to the | SECSH Working Group ietf-ssh@netbsd.org ftp:// ftp.ietf.org/ietf- | mail-archive/secsh/2002-02.mail, Feb 2002. NEW: | [DAI] Dai, W., "An attack against SSH2 protocol", Email to the | SECSH Working Group ietf-ssh@netbsd.org https://www.ietf.org/ietf- | ftp/ietf-mail-archive/ secsh/2002-02.mail, Feb 2002. 3.17. RFC 4323 The CONTACT-INFO in the MIB in Section 5 of [RFC4323] contains an outdated email archive reference. The revised reference is as follows: OLD: | Archive: ftp://ftp.ietf.org/ietf-mail-archive/ipcdn NEW: | Archive: https://www.ietf.org/ietf-ftp/ietf-mail-archive/ipcdn/ 3.18. RFC 4546 The CONTACT-INFO in the MIB in Section 4 of [RFC4546] contains an outdated email archive reference. The revised reference is as follows: OLD: | Archive: ftp://ftp.ietf.org/ietf-mail-archive/ipcdn NEW: | Archive: https://www.ietf.org/ietf-ftp/ietf-mail-archive/ipcdn/ 3.19. RFC 4547 The CONTACT-INFO in the MIB in Section 4 of [RFC4547] contains an outdated email archive reference. The revised reference is as follows: OLD: | Archive: ftp://ftp.ietf.org/ietf-mail-archive/ipcdn NEW: | Archive: https://www.ietf.org/ietf-ftp/ietf-mail-archive/ipcdn/ 3.20. RFC 4639 The CONTACT-INFO in the MIB in Section 4 of [RFC4639] contains an outdated email archive reference. The revised reference is as follows: OLD: | Archive: ftp://ftp.ietf.org/ietf-mail-archive/ipcdn NEW: | Archive: https://www.ietf.org/ietf-ftp/ietf-mail-archive/ipcdn/ 3.21. RFC 4682 The CONTACT-INFO in the MIB in Section 4 of [RFC4682] contains an outdated email archive reference. The revised reference is as follows: OLD: | Archive: ftp://ftp.ietf.org/ietf-mail-archive/ipcdn NEW: | Archive: https://www.ietf.org/ietf-ftp/ietf-mail-archive/ipcdn/ 3.22. RFC 5098 The CONTACT-INFO in the MIB in Section 5 of [RFC5098] contains an outdated email archive reference. The revised reference is as follows: OLD: | Archive: ftp://ftp.ietf.org/ietf-mail-archive/ipcdn NEW: | Archive: https://www.ietf.org/ietf-ftp/ietf-mail-archive/ipcdn/ 3.23. RFC 5428 The CONTACT-INFO in the MIB in Section 6 of [RFC5428] contains an outdated email archive reference. The revised reference is as follows: OLD: | Archive: ftp://ftp.ietf.org/ietf-mail-archive/ipcdn NEW: | Archive: https://www.ietf.org/ietf-ftp/ietf-mail-archive/ipcdn/ 3.24. RFC 6756 Section 2.8.1 of [RFC6756] is updated as follows: OLD: | Current list and status of all IETF RFCs: | | ftp://ftp.ietf.org/rfc/rfc-index.txt | | Current list and description of all IETF Internet-Drafts: | | ftp://ftp.ietf.org/internet-drafts/1id-abstracts.txt NEW: | Current list and status of all IETF RFCs: | | https://www.rfc-editor.org/rfc/rfc-index.txt | | Current list and description of all IETF Internet-Drafts: | | https://www.ietf.org/id/1id-abstracts.txt 3.25. RFC 7241 Appendix B.2 of [RFC7241] is updated as follows: OLD: | Current list and description of all IETF Internet-Drafts: | | <ftp://ftp.ietf.org/internet-drafts/1id-abstracts.txt> NEW: | Current list and description of all IETF Internet-Drafts: | | <https://www.ietf.org/id/1id-abstracts.txt> 3.26. Generic Guidance If any other RFC not explicitly mentioned in an earlier section contains a reference of the form "ftp://ftp.ietf.org/<path>", the reference MUST be replaced with a URI of the form "https://www.ietf.org/ietf-ftp/<path>". 4. Security Considerations This document does not alter the security considerations of the updated documents. This document replaces URIs to the IETF infrastructure that use an FTP scheme with equivalent HTTPS scheme URIs. These updates ensure the continued availability of content referenced in previously published RFCs when the IETF FTP service is retired. Additionally, the replacement of the cleartext FTP with HTTPS will ensure that resources on the IETF infrastructure can be accessed in a more secure way. For example, HTTPS provides an encrypted channel that includes protections, such as verifying the server's identity per the certificate verification behavior of the client and integrity and confidentiality protection commensurate with the negotiated TLS protocol version and ciphersuite. 5. IANA Considerations This document has no IANA actions. 6. References 6.1. Normative References [RFC2077] Nelson, S., Parks, C., and M. Ardron, "The Model Primary Content Type for Multipurpose Internet Mail Extensions", RFC 2077, DOI 10.17487/RFC2077, January 1997, <https://www.rfc-editor.org/info/rfc2077>. [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, March 1997, <https://www.rfc-editor.org/info/rfc2119>. [RFC2418] Bradner, S., "IETF Working Group Guidelines and Procedures", BCP 25, RFC 2418, DOI 10.17487/RFC2418, September 1998, <https://www.rfc-editor.org/info/rfc2418>. [RFC2648] Moats, R., "A URN Namespace for IETF Documents", RFC 2648, DOI 10.17487/RFC2648, August 1999, <https://www.rfc-editor.org/info/rfc2648>. [RFC2954] Rehbehn, K. and D. Fowler, "Definitions of Managed Objects for Frame Relay Service", RFC 2954, DOI 10.17487/RFC2954, October 2000, <https://www.rfc-editor.org/info/rfc2954>. [RFC2955] Rehbehn, K., Nicklass, O., and G. Mouradian, "Definitions of Managed Objects for Monitoring and Controlling the Frame Relay/ATM PVC Service Interworking Function", RFC 2955, DOI 10.17487/RFC2955, October 2000, <https://www.rfc-editor.org/info/rfc2955>. [RFC3020] Pate, P., Lynch, B., and K. Rehbehn, "Definitions of Managed Objects for Monitoring and Controlling the UNI/NNI Multilink Frame Relay Function", RFC 3020, DOI 10.17487/RFC3020, December 2000, <https://www.rfc-editor.org/info/rfc3020>. [RFC3083] Woundy, R., "Baseline Privacy Interface Management Information Base for DOCSIS Compliant Cable Modems and Cable Modem Termination Systems", RFC 3083, DOI 10.17487/RFC3083, March 2001, <https://www.rfc-editor.org/info/rfc3083>. [RFC3201] Steinberger, R. and O. Nicklass, "Definitions of Managed Objects for Circuit to Interface Translation", RFC 3201, DOI 10.17487/RFC3201, January 2002, <https://www.rfc-editor.org/info/rfc3201>. [RFC3202] Steinberger, R. and O. Nicklass, "Definitions of Managed Objects for Frame Relay Service Level Definitions", RFC 3202, DOI 10.17487/RFC3202, January 2002, <https://www.rfc-editor.org/info/rfc3202>. [RFC3295] Sjostrand, H., Buerkle, J., and B. Srinivasan, "Definitions of Managed Objects for the General Switch Management Protocol (GSMP)", RFC 3295, DOI 10.17487/RFC3295, June 2002, <https://www.rfc-editor.org/info/rfc3295>. [RFC3684] Ogier, R., Templin, F., and M. Lewis, "Topology Dissemination Based on Reverse-Path Forwarding (TBRPF)", RFC 3684, DOI 10.17487/RFC3684, February 2004, <https://www.rfc-editor.org/info/rfc3684>. [RFC3962] Raeburn, K., "Advanced Encryption Standard (AES) Encryption for Kerberos 5", RFC 3962, DOI 10.17487/RFC3962, February 2005, <https://www.rfc-editor.org/info/rfc3962>. [RFC3970] Kompella, K., "A Traffic Engineering (TE) MIB", RFC 3970, DOI 10.17487/RFC3970, January 2005, <https://www.rfc-editor.org/info/rfc3970>. [RFC4036] Sawyer, W., "Management Information Base for Data Over Cable Service Interface Specification (DOCSIS) Cable Modem Termination Systems for Subscriber Management", RFC 4036, DOI 10.17487/RFC4036, April 2005, <https://www.rfc-editor.org/info/rfc4036>. [RFC4131] Green, S., Ozawa, K., Cardona, E., Ed., and A. Katsnelson, "Management Information Base for Data Over Cable Service Interface Specification (DOCSIS) Cable Modems and Cable Modem Termination Systems for Baseline Privacy Plus", RFC 4131, DOI 10.17487/RFC4131, September 2005, <https://www.rfc-editor.org/info/rfc4131>. [RFC4251] Ylonen, T. and C. Lonvick, Ed., "The Secure Shell (SSH) Protocol Architecture", RFC 4251, DOI 10.17487/RFC4251, January 2006, <https://www.rfc-editor.org/info/rfc4251>. [RFC4323] Patrick, M. and W. Murwin, "Data Over Cable System Interface Specification Quality of Service Management Information Base (DOCSIS-QoS MIB)", RFC 4323, DOI 10.17487/RFC4323, January 2006, <https://www.rfc-editor.org/info/rfc4323>. [RFC4546] Raftus, D. and E. Cardona, "Radio Frequency (RF) Interface Management Information Base for Data over Cable Service Interface Specifications (DOCSIS) 2.0 Compliant RF Interfaces", RFC 4546, DOI 10.17487/RFC4546, June 2006, <https://www.rfc-editor.org/info/rfc4546>. [RFC4547] Ahmad, A. and G. Nakanishi, "Event Notification Management Information Base for Data over Cable Service Interface Specifications (DOCSIS)-Compliant Cable Modems and Cable Modem Termination Systems", RFC 4547, DOI 10.17487/RFC4547, June 2006, <https://www.rfc-editor.org/info/rfc4547>. [RFC4639] Woundy, R. and K. Marez, "Cable Device Management Information Base for Data-Over-Cable Service Interface Specification (DOCSIS) Compliant Cable Modems and Cable Modem Termination Systems", RFC 4639, DOI 10.17487/RFC4639, December 2006, <https://www.rfc-editor.org/info/rfc4639>. [RFC4682] Nechamkin, E. and J-F. Mule, "Multimedia Terminal Adapter (MTA) Management Information Base for PacketCable- and IPCablecom-Compliant Devices", RFC 4682, DOI 10.17487/RFC4682, December 2006, <https://www.rfc-editor.org/info/rfc4682>. [RFC5098] Beacham, G., Kumar, S., and S. Channabasappa, "Signaling MIB for PacketCable and IPCablecom Multimedia Terminal Adapters (MTAs)", RFC 5098, DOI 10.17487/RFC5098, February 2008, <https://www.rfc-editor.org/info/rfc5098>. [RFC5428] Channabasappa, S., De Ketelaere, W., and E. Nechamkin, "Management Event Management Information Base (MIB) for PacketCable- and IPCablecom-Compliant Devices", RFC 5428, DOI 10.17487/RFC5428, April 2009, <https://www.rfc-editor.org/info/rfc5428>. [RFC6756] Trowbridge, S., Ed., Lear, E., Ed., Fishman, G., Ed., and S. Bradner, Ed., "Internet Engineering Task Force and International Telecommunication Union - Telecommunication Standardization Sector Collaboration Guidelines", RFC 6756, DOI 10.17487/RFC6756, September 2012, <https://www.rfc-editor.org/info/rfc6756>. [RFC7241] Dawkins, S., Thaler, P., Romascanu, D., and B. Aboba, Ed., "The IEEE 802/IETF Relationship", RFC 7241, DOI 10.17487/RFC7241, July 2014, <https://www.rfc-editor.org/info/rfc7241>. [RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174, May 2017, <https://www.rfc-editor.org/info/rfc8174>. 6.2. Informative References [FTP-RETIREMENT] Danyliw, R., "Retirement of the IETF FTP Service", message to the IETF mailing list, 3 March 2021, <https://mailarchive.ietf.org/arch/msg/ietf/vi- 8bFqlgBFjB2jJ1SIAGHiNRdg/>. [FTP-RETIREMENT-PLAN] "Retiring the IETF FTP Service (Revised Plan)", March 2021, <https://www.ietf.org/media/documents/Revised- Retiring-IETF-FTP-Service-2021-03.pdf>. Acknowledgments Thank you to Robert Sparks, Glen Barney, Henrik Levkowetz, and Russ Housley on the IETF Tools Team for the operations and maintenance information that informed the community discussion at [FTP-RETIREMENT]. Additionally, thank you to Brian Carpenter, Martin Duke, Russ Housley, Benjamin Kaduk, Eric Kline, Murray Kucherawy, Mirja Kühlewind, Scott Mansfield, Tom Petch, John Scudder, and Rob Wilton for their valuable feedback and reviews of the specific document updates. Finally, thank you to Éric Vyncke for the sponsoring this document and the AD review. Author's Address Roman Danyliw Software Engineering Institute Email: rdd@cert.org