Re: [Webpush] Ben Campbell's Yes on draft-ietf-webpush-protocol-11: (with COMMENT)

[Spencer Dawkins at IETF <[e-mail]>]

On Wed, Oct 12, 2016 at 4:25 PM, Ben Campbell <[e-mail]> wrote:

> Ben Campbell has entered the following ballot position for
> draft-ietf-webpush-protocol-11: Yes
>
> When responding, please keep the subject line intact and reply to all
> email addresses included in the To and CC lines. (Feel free to cut this
> introductory paragraph, however.)
>
>
> Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
> for more information about IESG DISCUSS and COMMENT positions.
>
>
> The document, along with other ballot positions, can be found here:
> https://datatracker.ietf.org/doc/draft-ietf-webpush-protocol/
>
>
>
> ----------------------------------------------------------------------
> COMMENT:
> ----------------------------------------------------------------------
>
> Thanks for a well written document. I have a few questions on one topic,
> for which the answers may be obvious to people other than me:
>
> In section 8, 2nd paragraph: "Applications using this protocol MUST use
> mechanisms that provide
>    confidentiality, integrity and data origin authentication."
>
> What must it use those mechanisms for? Are we talking about communication
> between the UA and app servers? Are we just talking about data in motion?
>  As much as I like to see such requirements in general, is it reasonable
> for webpush to state requirements on the internal operation of the
> application?
>

For what it's worth, I didn't understand whether the mandatory HTTP over
TLS (right?) satisfies this MUST, or whether it meant something completely
different.

So I'm also curious about Ben's comment.