Subject: [Webpush] Kathleen Moriarty's No Objection on draft-ietf-webpush-protocol-11: (with COMMENT)

From: "Kathleen Moriarty" <[email-masked]>
Date: Wed, 12 Oct 2016 11:26:24 -0700

Kathleen Moriarty has entered the following ballot position for
draft-ietf-webpush-protocol-11: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-webpush-protocol/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Thank you for a well written security considerations section. 

The only thing I might add is a note on the varying levels of security
offered by the HTTP authentication methods, which are documented in their
RFCs.  Adding just that point to the following (phrased however you'd
like) would be helpful:
    A push service MAY
   choose to authorize requests based on any HTTP-compatible
   authorization method available, of which there are numerous options.

The somewhat recent updates to Basic & Digest do a really great job at
saying how awful they are and there are some experimental options that
offer some promise now.

---

From: Brian Raymor <[email-masked]>
Date: Thu, 13 Oct 2016 01:09:02 +0000

> saying how awful they are and there are some experimental options that

Proposed text - https://github.com/webpush-wg/webpush-protocol/pull/139/files

---

From: [email-masked]
Date: Wed, 12 Oct 2016 21:51:34 -0400

Please excuse typos, sent from handheld device 

> On Oct 12, 2016, at 9:09 PM, Brian Raymor <[email-masked]> wrote:
> 
> 

Thanks for the quick update.  I would just say 'with varying levels of security.'  The security considerations sections for each of the methods available for HTTP are included in the RFCs for each.

Thank you,
Kathleen

---

From: Brian Raymor <[email-masked]>
Date: Thu, 13 Oct 2016 04:04:30 +0000

Done.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] 
Sent: Wednesday, October 12, 2016 6:52 PM
To: Brian Raymor <[email-masked]>
Cc: The IESG <[email-masked]>; [email-masked]; Shida Schubert <[email-masked]>; [email-masked]; [email-masked]
Subject: Re: Kathleen Moriarty's No Objection on draft-ietf-webpush-protocol-11: (with COMMENT)

Thank you,
Kathleen

---

From: Kathleen Moriarty <[email-masked]>
Date: Thu, 13 Oct 2016 10:09:01 -0400

> Done.
Thank you!

> Cc: The IESG <[email-masked]>; [email-masked]; Shida
> Schubert <[email-masked]>; [email-masked]; [email-masked]
> Subject: Re: Kathleen Moriarty's No Objection on
> draft-ietf-webpush-protocol-11: (with COMMENT)
>
>
>
> Thanks for the quick update.  I would just say 'with varying levels of
> security.'  The security considerations sections for each of the methods
> available for HTTP are included in the RFCs for each.
>
> Thank you,
> Kathleen
> >
> >
> >
>

-- 

Best regards,
Kathleen