Re: [saag] Last Call: <draft-foudil-securitytxt-08.txt> (A Method for Web Security Policies) to Informational RFC

[S Moonesamy <[e-mail]>]

At 09:39 AM 09-12-2019, The IESG wrote:
>The IESG has received a request from an individual submitter to consider the
>following document: - 'A Method for Web Security Policies'
>   <draft-foudil-securitytxt-08.txt> as Informational RFC
>
>The IESG plans to make a decision in the next few weeks, and solicits final
>comments on this action. Please send substantive comments to the
>[e-mail] mailing lists by 2020-01-06. Exceptionally, comments may

Section 1.1 of the draft states that it is about helping 
organizations to communicate information about their security 
disclosure policies.  Is the field defined in Section 3.5.6 optional?

Section 3 sets a requirement for the file (security.txt) to be 
accessible via HTTP and references RFC 1945.  Does it mean that the 
file must be accessible using HTTP/1/0?

Section 3.1 specifies that the file would only apply to the domain in 
the URI.  The examples given in that section states that the file 
also applies to to IPv4 and IPv6 addresses.

There is a requirement in Section 3.3 for the line separator to be 
either CRLF or LF.  Have the authors considered using only one 
convention for specifying the end of line?

Have the authors considered line limits given that the specification 
defines a machine-parsable format?

Why does the robustness principle require capital letters? (Section 4)?

How will the designated expert determine whether a proposed 
registration (Section 7.2) provides value?  What is the "wider 
Internet community"?

How should "MAY assume that English is the default language to be 
used" be interpreted (Section 3.5.7)?  RFC 2777 states that 
"i-default" is not a specific language.

As an overall comment, there are a lot of requirements and 
recommendations (please see RFC 2119) in the draft.  There is, for 
example, a restatement of a requirement: "The value MUST follow the 
URI syntax described in [RFC3986].  This means that "mailto" and 
"tel" URI schemes MUST be used when specifying email addresses and 
telephone numbers, as defined in [RFC6068] and [RFC3966]".  Does that 
comply with the ABNF defined in Section 5?

Regards,
S. Moonesamy