Re: [HASMAT] HASMAT/Websec Charter Proposal - last call - comments until Sep-8

[Tobias Gondrom <[e-mail]>]

 Dear Julian,
thanks a lot for your feedback. I corrected the points you mentioned
except for the "buzzword part". Answers inline.
I think we are ready to go now.
Best regards, Tobias


On 09/08/2010 02:38 PM, Julian Reschke wrote:
> On 04.09.2010 18:16, Tobias Gondrom wrote:
>>   Dear all,
>>
>> as I haven't seen too much controversy on the charter, to get the work
>> going I like to close final comments on the initial charter and the name
>> of the new WG until Sep-8. After that we should submit the final
>> proposal to the AD and get to the more important work on the drafts.
>> Best regards, Tobias
>>
>>
>> Ps.: We need to finish the formal stuff (name, charter) for the WG until
>> Sep-12 so that we are in time before the cut-off date to book the
>> meeting slot for Beijing and so we can focus on the real stuff: the
>> drafts.
>>
>>
>>
>> ======================================================
>>
>>
>> Charter for WebSec -- Web Security WG
>>
>> Problem Statement
>>
>> Although modern Web applications are built on top of HTTP, they provide
>> rich functionality and have requirements beyond the original vision of
>> static web pages.  HTTP, and the applications built on it, have evolved
>> organically.  Over the past few years, we have seen a proliferation of
>> AJAX-based web applications (AJAX being shorthand for asynchronous
>> JavaScript and XML), as well as Rich Internet Applications (RIAs), based
>> on so-called Web 2.0 technologies.  These applications bring both
>> luscious eye-candy and convenient functionality, e.g. social networking,
>> to their users, making them quite compelling.  At the same time, we are
>> seeing an increase in attacks against these applications and their
>> underlying technologies.
>
> This has many Buzzwords. Maybe it could be shortened.
Hm, yes maybe, reminds me of Pascal ("I have made this [letter] longer,
because I have not had the time to make it shorter.") Shortening it
would have required rewriting it, which would mean new review (and time
delay), so left the Problem Statement as it is with the buzzwords.

>> The list of attacks is long and includes Cross-Site-Request Forgery
>> (CSRF)-based attacks, content-sniffing cross-site-scripting (XSS)
>
> "content-sniffing cross-site-scripting"?
>
thanks. Added the comma between the words.

>> ...
>> This working group will work closely with IETF Apps Area WGs (such as
>> HYBI, HTTPstate, and HTTPbis), as well as appropriate W3C working
>> group(s)
>> (e.g. HTML5, WebApps).
>
> It's the W3C "HTML" Working Group...
>
Corrected.
>> References
>>
>> [1] Hodges and Steingruebl, "The Need for a Coherent Web Security Policy
>> Framework", W2SP position paper, 2010.
>> http://w2spconf.com/2010/papers/p11.pdf
>>
>> Appendix
>>
>> A. Relationship of Origin work in IETF WebSec and in W3C HTML5
>>
>> draft-abarth-origin defines the nuts-and-bolts of working with
>> origins (computing them from URLs, comparing them to each other, etc).
> > ...
>
> From URIs or IRIs, I assume :-)
Yes, it's URI. Corrected.

>
> Best regards, Julian