Subject: [Webpush] Warren Kumari's No Objection on draft-ietf-webpush-encryption-08: (with COMMENT)

From: Warren Kumari <[email-masked]>
Date: Tue, 15 Aug 2017 10:59:57 -0700

Warren Kumari has entered the following ballot position for
draft-ietf-webpush-encryption-08: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-webpush-encryption/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Firstly, thanks to Tim Chown for his helpful OpsDir review (
https://datatracker.ietf.org/doc/review-ietf-webpush-encryption-08-opsdir-lc-chown-2017-08-01/
) and for your response.

I only have nits on this document:
1:  I reviewed this and draft-ietf-webpush-vapid together. This document uses
title case for "User Agent" (and many other terms), while
draft-ietf-webpush-vapid and RFC8030 uses lower-case. Consistency would be nice
here.

2: Section 2:
"In addition to the reasons described in [I-D.ietf-webpush-protocol], this
ensures that the authentication secret is not revealed to unauthorized
entities, which can be used to generate push messages that will be accepted by
the User Agent." -- this is ambiguous / confusing. It is unclear which which is
which. I'd suggest rewording to something like "... to unauthorized entities,
which would allow that entities to generate push messages that would be
accepted by the User Agent as valid" (or similar)

3: Section 7.  Security Considerations
"In particular, any HTTP header fields are not protected by the content
encoding scheme." -- I think you may mean "In particular, no HTTP header fields
are protected ..." (or similar)

---

From: Martin Thomson <[email-masked]>
Date: Wed, 16 Aug 2017 10:16:26 +1000

Hi Warren,

I resolved your nits here:
  https://github.com/webpush-wg/webpush-encryption/pull/19

On 16 August 2017 at 03:59, Warren Kumari <[email-masked]> wrote:
> _______________________________________________
> Webpush mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/webpush

---

From: Warren Kumari <[email-masked]>
Date: Tue, 15 Aug 2017 20:19:09 -0400

Awesome, thank you, LGTM.

W

-- 
I don't think the execution is relevant when it was obviously a bad
idea in the first place.
This is like putting rabid weasels in your pants, and later expressing
regret at having chosen those particular rabid weasels and that pair
of pants.
   ---maf