[Webpush] Ben Campbell's Yes on draft-ietf-webpush-protocol-11: (with COMMENT)

["Ben Campbell" <[e-mail]>]

Ben Campbell has entered the following ballot position for
draft-ietf-webpush-protocol-11: Yes

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)


Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.


The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-webpush-protocol/



----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Thanks for a well written document. I have a few questions on one topic,
for which the answers may be obvious to people other than me:

In section 8, 2nd paragraph: "Applications using this protocol MUST use
mechanisms that provide
   confidentiality, integrity and data origin authentication."

What must it use those mechanisms for? Are we talking about communication
between the UA and app servers? Are we just talking about data in motion?
 As much as I like to see such requirements in general, is it reasonable
for webpush to state requirements on the internal operation of the
application?