Re: [secdir] secdir review of draft-nottingham-http-link-header

[Mark Nottingham <[e-mail]>]

Thanks, Sean.

I'm not sure how to incorporate your suggestion into the document; did  
you have specific mechanisms in mind, and/or specific placement in the  
draft?

Cheers,


On 30/07/2009, at 7:02 PM, Sean Turner wrote:

> I have reviewed this document as part of the security directorate's  
> ongoing effort to review all IETF documents being processed by the  
> IESG.  These comments were written primarily for the benefit of the  
> security area directors.  Document editors and WG chairs should  
> treat these comments just like any other last call comments.
>
> Document: draft-nottingham-http-link-header-06.txt
> Reviewer: Sean Turner
> Review Date: 2009-07-30
> IETF LC End Date: 2009-08-11
> IESG Telechat date: N/A
>
> Summary: This document specifies relation types for Web links, and  
> defines a registry for them.  It also defines how to send such links  
> in HTTP headers with the Link header-field.
>
> Comments: The security considerations are pretty clear: the content  
> of the fields aren't secured in any way. I think some text should be  
> added that says something like "[Mechanism XYZ] can be combined with  
> [protocol ABC] to provide the following security service: 1, 2, 3."
>
> spt


--
Mark Nottingham     http://www.mnot.net/