[drinks] Kathleen Moriarty's Discuss on draft-ietf-drinks-spp-framework-09: (with DISCUSS and COMMENT)

["Kathleen Moriarty" <[e-mail]>]

Kathleen Moriarty has entered the following ballot position for
draft-ietf-drinks-spp-framework-09: Discuss

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)


Please refer to http://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.


The document, along with other ballot positions, can be found here:
http://datatracker.ietf.org/doc/draft-ietf-drinks-spp-framework/



----------------------------------------------------------------------
DISCUSS:
----------------------------------------------------------------------

In section 8, would it be appropriate to require that the XML is well
formed and validated to prevent application and security issues?  I think
a simple statement to that effect would be helpful in this document. 

I'd be fine with seeing text in subsequent documents that tells you how
to handle non-conformance to the schema or other issues that might result
in a validation problem (if restrictions for this go beyond XML
conformance).


----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Thanks for addressing the SecDir review from 2 years ago.  I see that you
have added text to 9.1 to say integrity protection and confidentiality
protections are to be supported by the transport protocol.  This and the
other considerations look good.
http://www.ietf.org/mail-archive/web/secdir/current/msg03495.html