IETF Logo Mail Archive

[OAUTH-WG] review draft-ietf-oauth-native-apps-07

Samuel Erdtman <samuel@erdtman.se> Tue, 21 February 2017 06:04 UTC

Return-Path: <samuel@erdtman.se>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F35FD129B11 for <oauth@ietfa.amsl.com>; Mon, 20 Feb 2017 22:04:41 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.599
X-Spam-Level:
X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7] autolearn=unavailable autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=erdtman-se.20150623.gappssmtp.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4FiPNhcNjoth for <oauth@ietfa.amsl.com>; Mon, 20 Feb 2017 22:04:41 -0800 (PST)
Received: from mail-oi0-x234.google.com (mail-oi0-x234.google.com [IPv6:2607:f8b0:4003:c06::234]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 278981296A1 for <oauth@ietf.org>; Mon, 20 Feb 2017 21:57:20 -0800 (PST)
Received: by mail-oi0-x234.google.com with SMTP id 2so23738652oif.0 for <oauth@ietf.org>; Mon, 20 Feb 2017 21:57:20 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=erdtman-se.20150623.gappssmtp.com; s=20150623; h=mime-version:from:date:message-id:subject:to:cc; bh=37tJguPbQ5vfldBAGmMtvoLNocXAqnIDLs9HGEAdAgw=; b=ZAROpUwL7GlgqYX4eTRxT4vk47V2CL8kDmF0axV+fE6dhSvOtdtfEKXBbFV6DhQlY2 Ukg+A64N8vjddDrgGjZPS6Em7higzb4B3Axsudr59EN77Gmx7a21asEHBacjm4fyAcLf Mrw675kAkqO0f84SZXX0TXwJZ9uQciySuerzjcJ1onmdey63DtnrbUbkNdNqWdOFV9h5 yYYJOgGher5gvraSKI4pw833Un5X8QgvEIeNBKinsv0+Uz+Kq5B0/Rd1f/r0QAWBfaaR gfvZEVgKeLQTYwO8qSzdhUYcZhM1WoIji4m04VRoEcFnvoRxJA9W59iasbONk+hfka2M 8rFg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to:cc; bh=37tJguPbQ5vfldBAGmMtvoLNocXAqnIDLs9HGEAdAgw=; b=Sbz7HEOrr3YPD4kCBVKcYvn0irWq3glePuKJNFkzftGNtrhvepmybRC76AXLVezqRP 1+yRX/2Wu3cFaWP+xRclNwIYWkBPX4qCqO4XdeL7S5NhF1Ok8SYCWE+Iuga49qXfn/wZ zhfsZNvGVTXKXCg2Lj0V4k16Vos3/lVH3SYKQ1ltejxnPaZkVYR7PneApqlTaZmnUiDg WtZOyPm7bg+MRz4dmoNQdn2UD2o3FQPVrGNVqre+DcWARTLJrpD7r4zIBNkkybPGk8A9 olrXCQDHoPB59162jpe0RgxRoSRfzNfCnxOTMCzEF/y7oFo665k4MIbmu/JwPbTN1RFr Decw==
X-Gm-Message-State: AMke39mes/sbWfnTLo2Mm29dkZGuvbHBMgiRkjaMVeUesRT9qJ6XmNtx0HOStIMDnxJuEz0i0wm5w/ySGKhanw==
X-Received: by 10.202.7.68 with SMTP id 65mr7694175oih.34.1487656639904; Mon, 20 Feb 2017 21:57:19 -0800 (PST)
MIME-Version: 1.0
Received: by 10.182.8.74 with HTTP; Mon, 20 Feb 2017 21:57:19 -0800 (PST)
From: Samuel Erdtman <samuel@erdtman.se>
Date: Tue, 21 Feb 2017 06:57:19 +0100
Message-ID: <CAF2hCbYL_hi1_kAXhYDcY7vx+iVA0Gf664BN+2jS2OOEGU16eQ@mail.gmail.com>
To: William Denniss <wdenniss@google.com>, John Bradley <ve7jtb@ve7jtb.com>
Content-Type: multipart/alternative; boundary="94eb2c13f24891d0e70549040ddb"
Archived-At: <https://mailarchive.ietf.org/arch/msg/oauth/fH0eo6Mg8lRNqFTyc1G42GnBpr4>
Cc: Hannes Tschofenig <Hannes.Tschofenig@arm.com>, "<oauth@ietf.org>" <oauth@ietf.org>
Subject: [OAUTH-WG] review draft-ietf-oauth-native-apps-07
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/oauth/>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 21 Feb 2017 06:04:42 -0000

Hi,

I just had a question on best practice. In this document a large part of
the normative text is located under Security Considerations.

I had previously seen Security Considerations as things to think about when
implementing not so much as MUSTs and MUST NOTs.

I think it is okay to have it this way but it surprised me a bit and wanted
to ask if there is any best practice for the Security Considerations
section saying what type of information it should include.

Best Regards
Samuel Erdtman

v2.23.0 | Report a Bug | By Email