Re: [apps-discuss] Kathleen Moriarty's Discuss on draft-ietf-appsawg-json-merge-patch-06: (with DISCUSS)

[James M Snell <[e-mail]>]

In the case of using Merge-Patch with the HTTP Patch method,
"validation" would typically occur using the Conditional HTTP Request
Mechanisms (ETags and If-Match/If-None-Match). These aren't fool
proof, of course, but they provide a Good Enough approximation. If
someone needed something more rigorous, they could layer it in.

- James

On Mon, Aug 18, 2014 at 1:58 PM, Kathleen Moriarty
<[e-mail]> wrote:
> Kathleen Moriarty has entered the following ballot position for
> draft-ietf-appsawg-json-merge-patch-06: Discuss
>
> When responding, please keep the subject line intact and reply to all
> email addresses included in the To and CC lines. (Feel free to cut this
> introductory paragraph, however.)
>
>
> Please refer to http://www.ietf.org/iesg/statement/discuss-criteria.html
> for more information about IESG DISCUSS and COMMENT positions.
>
>
> The document, along with other ballot positions, can be found here:
> http://datatracker.ietf.org/doc/draft-ietf-appsawg-json-merge-patch/
>
>
>
> ----------------------------------------------------------------------
> DISCUSS:
> ----------------------------------------------------------------------
>
> The draft looks very good and the security considerations in RFC5789
> cover most of the bases I would be concerned with.  I do have a question
> I'd like to discuss to see if it applies or not.
>
> Normally, in other spaces patches are validated and that might be as
> simple as making sure the hash of the patch provided by the source
> matches the value you calculated (not corrupted, *should* be from the
> source you think it's from).  I don't see any mention of this practice,
> is there a reason for that or should it be added?  Maybe it's not
> possible because of how the patch is delivered over HTTP, but I figured
> it was worth flagging to discuss quickly.
>
>
>
>