From: Richard L. Barnes <rbarnes@bbn.com>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: quoted-printable
Date: Mon, 4 Jun 2012 08:33:40 -0400
Message-Id: <196B9066-2934-443D-B642-997BDF57948E@bbn.com>
To: ietf@ietf.org, IESG <iesg@ietf.org>, gen-art@ietf.org
Mime-Version: 1.0 (Apple Message framework v1278)
Subject: [Gen-art] Gen-ART Telechat review of
 draft-ietf-appsawg-about-uri-scheme-05
Precedence: list

I am the assigned Gen-ART reviewer for this draft. For background on
Gen-ART, please see the FAQ at
<http://wiki.tools.ietf.org/area/gen/trac/wiki/GenArtfaq>.

Please resolve these comments along with any other Last Call comments
you may receive.

Document: draft-ietf-appsawg-about-uri-scheme-05
Reviewer: Richard Barnes
Review Date: Jun-04-2012
IETF LC End Date: Not known
IESG Telechat date: Jun-07-2012

Summary: Almost ready, couple of questions

MAJOR:=20

*.
I wonder how useful this document is, given that the use of "about:" =
URIs is currently very inconsistent across browsers. (See, for example, =
<http://en.wikipedia.org/wiki/About_URI_scheme>)  Some browsers also use =
alternative URI schemes for essentially the same function ("opera:", =
"chrome:").  Has there been input from the browser vendor community on =
this document? =20


4.
The document correctly notes that "about:" URIs sometimes point to =
sensitive data, and that browsers need to protect them.  However, the =
document fails to specify what the threats are and how to mitigate them. =
 It seems to me that the major risk is cross-site scripting, in the =
sense that a remote web page might include an "about:" URI (e.g., via an =
XMLHttpRequest) in order to access sensitive data.  At a high level, =
then, the mitigation would be to ensure that such URIs are accessible =
only as a result of direct user action (e.g., typing in a URI) or =
trusted browser code (e.g., extensions).