On Sep 30, 2004, at 2:37 PM, Dave Crocker wrote:
As I said, one can start with concrete specifications and seek to
do minimal changes, or one can go down the path of a working
group design and development project, starting with a clean
slate.
Requirements are not contrary to either approach. However, saying that
we will be unable to produce requirements but able to produce a
specification is akin to saying that we can tell people how something
works but cannot tell them what it does.
ps. my query about the amount of time to budget for the
requirements exercise was serious. if you believe it essential
to do, then we need to work through the details. how long is
realistic to produce the formal requirements document?
Well, you already have "Nov 04 Consensus statement of threat analysis
and requirements" which I think is optimistic.
It would be more realistic if it were Jan 05. And just a consensus
statement is fine by me as long as everybody realizes that is what we
are signing up to do. Producing an Information RFC is what is common,
but a consensus statement regarding threats analysis and requirements
also works for me.
However, I would like to know what you mean when you say "requirements"
here. Are these feature requirements or function requirements or both?
-andy