Subject: [Webpush] Ben Campbell's Yes on draft-ietf-webpush-protocol-11: (with COMMENT)

From: "Ben Campbell" <[email-masked]>
Date: Wed, 12 Oct 2016 14:25:46 -0700

Ben Campbell has entered the following ballot position for
draft-ietf-webpush-protocol-11: Yes

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-webpush-protocol/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Thanks for a well written document. I have a few questions on one topic,
for which the answers may be obvious to people other than me:

In section 8, 2nd paragraph: "Applications using this protocol MUST use
mechanisms that provide
   confidentiality, integrity and data origin authentication."

What must it use those mechanisms for? Are we talking about communication
between the UA and app servers? Are we just talking about data in motion?
 As much as I like to see such requirements in general, is it reasonable
for webpush to state requirements on the internal operation of the
application?

---

From: Spencer Dawkins at IETF <[email-masked]>
Date: Wed, 12 Oct 2016 16:29:42 -0500

> https://datatracker.ietf.org/doc/draft-ietf-webpush-protocol/

For what it's worth, I didn't understand whether the mandatory HTTP over
TLS (right?) satisfies this MUST, or whether it meant something completely
different.

So I'm also curious about Ben's comment.

---

From: "Ben Campbell" <[email-masked]>
Date: Wed, 12 Oct 2016 17:12:22 -0500

On 12 Oct 2016, at 16:29, Spencer Dawkins at IETF wrote:

>> Please refer to 
>> https://www.ietf.org/iesg/statement/discuss-criteria.html

Ah, right, I guess it could mean that. I assumed that it was talking 
about something not already covered by the other TLS requirements.

---

From: Spencer Dawkins at IETF <[email-masked]>
Date: Wed, 12 Oct 2016 18:48:22 -0500

Hi, Ben,

Yeah, I was kinda guessing, too :-)

---

From: Martin Thomson <[email-masked]>
Date: Thu, 13 Oct 2016 11:01:13 +1100

> for webpush to state requirements on the internal operation of the

This specifically refers to the work in draft-ietf-webpush-encryption,
which covers these things.  We should add a f'rexample there.  Brian,
does that sound right?

(Yes, TLS is mandatory, but hop-by-hop mechanisms don't cover all the bases.)

---

From: Spencer Dawkins at IETF <[email-masked]>
Date: Wed, 12 Oct 2016 19:13:01 -0500

Hi, Martin,

> (Yes, TLS is mandatory, but hop-by-hop mechanisms don't cover all the
bases.)

Make Ben happy, because it's his comment, but that would have significantly
helped me understand!

Spencer

---

From: "Ben Campbell" <[email-masked]>
Date: Wed, 12 Oct 2016 19:21:04 -0500

> Make Ben happy, because it's his comment, but that would have 

Who said I wasn't happy? :-)

But I think I now understand this to mean e2e protection, at least with 
respect to the push service. Some clarification would help. Also, that 
seems conceptually bound more to section 8.1 than 8. (Or was 8.1 
intended to expand on the mention in 8?)

Ben.

---

From: Martin Thomson <[email-masked]>
Date: Thu, 13 Oct 2016 11:33:28 +1100

On 13 October 2016 at 11:21, Ben Campbell <[email-masked]> wrote:
> respect to the push service. Some clarification would help. Also, that seems
> conceptually bound more to section 8.1 than 8. (Or was 8.1 intended to
> expand on the mention in 8?)

Yes, we should be clearer.  And yes, 8.1 was intended to expand on the
intro to Section 8.  Now that I look at this again, it's probably
better to move that statement to 8.1.
I hope this helps: https://github.com/webpush-wg/webpush-protocol/pull/138

---

From: "Ben Campbell" <[email-masked]>
Date: Wed, 12 Oct 2016 19:51:16 -0500

On 12 Oct 2016, at 19:33, Martin Thomson wrote:

> I hope this helps: 
> https://github.com/webpush-wg/webpush-protocol/pull/138

That works for me.

Thanks!

Ben.

---

From: Spencer Dawkins at IETF <[email-masked]>
Date: Wed, 12 Oct 2016 22:12:45 -0500

Hi, Martin,

>>> respect to the push service. Some clarification would help. Also, that
seems
> That works for me.

That's superb.

And of course I meant that I didn't know whether Ben was happy YET :-)

Spencer