[HASMAT] wrt devising a more coherent policy mechanism

[=JeffH <[e-mail]>]

AndyS said..
 >
 > Lots of things are currently out there scattered all over:
 >
 > X-Frame-Options CSP STS No-Sniff And even headers to turn off XSS
 > sanitization features in browsers for a given site.
 >
 > What we're hoping to do through some of the HASMAT work is condense a lot of
 > that into a more coherent policy mechanism, and add a few things  (and I'm
 > just brainstorming here).  Ideally these policies could be controlled in one
 > place and wouldn't have to get set for every response by a site, they could
 > be centrally controlled and authoritative.

Eventually, yes. Note that the proposed HASMAT charter..

   Re: [HASMAT] HASMAT Charter Proposal
   http://www.ietf.org/mail-archive/web/hasmat/current/msg00006.html


..doesn't go into the "more coherent policy mechanism" work, although it does 
propose concocting a "problem statement and requirements" document that can be 
used to guide further work, i.e. addressing the former "more coherent policy 
mechanism" work after re-chartering the WG.

In other words, let's put our heads down and get these present specs finished, 
and do some requirements gathering before addressing such a big open-ended 
question.

thanks,

=JeffH