Re: [HASMAT] HASMAT/Websec Charter Proposal - last call - comments until Sep-8

[Julian Reschke <[e-mail]>]

On 04.09.2010 18:16, Tobias Gondrom wrote:
>   Dear all,
>
> as I haven't seen too much controversy on the charter, to get the work
> going I like to close final comments on the initial charter and the name
> of the new WG until Sep-8. After that we should submit the final
> proposal to the AD and get to the more important work on the drafts.
> Best regards, Tobias
>
>
> Ps.: We need to finish the formal stuff (name, charter) for the WG until
> Sep-12 so that we are in time before the cut-off date to book the
> meeting slot for Beijing and so we can focus on the real stuff: the drafts.
>
>
>
> ======================================================
>
>
> Charter for WebSec -- Web Security WG
>
> Problem Statement
>
> Although modern Web applications are built on top of HTTP, they provide
> rich functionality and have requirements beyond the original vision of
> static web pages.  HTTP, and the applications built on it, have evolved
> organically.  Over the past few years, we have seen a proliferation of
> AJAX-based web applications (AJAX being shorthand for asynchronous
> JavaScript and XML), as well as Rich Internet Applications (RIAs), based
> on so-called Web 2.0 technologies.  These applications bring both
> luscious eye-candy and convenient functionality, e.g. social networking,
> to their users, making them quite compelling.  At the same time, we are
> seeing an increase in attacks against these applications and their
> underlying technologies.

This has many Buzzwords. Maybe it could be shortened.

> The list of attacks is long and includes Cross-Site-Request Forgery
> (CSRF)-based attacks, content-sniffing cross-site-scripting (XSS)

"content-sniffing cross-site-scripting"?

> ...
> This working group will work closely with IETF Apps Area WGs (such as
> HYBI, HTTPstate, and HTTPbis), as well as appropriate W3C working group(s)
> (e.g. HTML5, WebApps).

It's the W3C "HTML" Working Group...

> References
>
> [1] Hodges and Steingruebl, "The Need for a Coherent Web Security Policy
> Framework", W2SP position paper, 2010.
> http://w2spconf.com/2010/papers/p11.pdf
>
> Appendix
>
> A. Relationship of Origin work in IETF WebSec and in W3C HTML5
>
> draft-abarth-origin defines the nuts-and-bolts of working with
> origins (computing them from URLs, comparing them to each other, etc).
 > ...

 From URIs or IRIs, I assume :-)

Best regards, Julian