Re: [Webpush] Ben Campbell's Yes on draft-ietf-webpush-protocol-11: (with COMMENT)

["Ben Campbell" <[e-mail]>]

On 12 Oct 2016, at 16:29, Spencer Dawkins at IETF wrote:

> On Wed, Oct 12, 2016 at 4:25 PM, Ben Campbell <[e-mail]> wrote:
>
>> Ben Campbell has entered the following ballot position for
>> draft-ietf-webpush-protocol-11: Yes
>>
>> When responding, please keep the subject line intact and reply to all
>> email addresses included in the To and CC lines. (Feel free to cut 
>> this
>> introductory paragraph, however.)
>>
>>
>> Please refer to 
>> https://www.ietf.org/iesg/statement/discuss-criteria.html
>> for more information about IESG DISCUSS and COMMENT positions.
>>
>>
>> The document, along with other ballot positions, can be found here:
>> https://datatracker.ietf.org/doc/draft-ietf-webpush-protocol/
>>
>>
>>
>> ----------------------------------------------------------------------
>> COMMENT:
>> ----------------------------------------------------------------------
>>
>> Thanks for a well written document. I have a few questions on one 
>> topic,
>> for which the answers may be obvious to people other than me:
>>
>> In section 8, 2nd paragraph: "Applications using this protocol MUST 
>> use
>> mechanisms that provide
>>    confidentiality, integrity and data origin authentication."
>>
>> What must it use those mechanisms for? Are we talking about 
>> communication
>> between the UA and app servers? Are we just talking about data in 
>> motion?
>>  As much as I like to see such requirements in general, is it 
>> reasonable
>> for webpush to state requirements on the internal operation of the
>> application?
>>
>
> For what it's worth, I didn't understand whether the mandatory HTTP 
> over
> TLS (right?) satisfies this MUST, or whether it meant something 
> completely
> different.
>

Ah, right, I guess it could mean that. I assumed that it was talking 
about something not already covered by the other TLS requirements.

> So I'm also curious about Ben's comment.