Re: [websec] #40: Various editorial comments on -06

"websec issue tracker" <> Tue, 12 June 2012 18:27 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 0B3AC21F845B for <>; Tue, 12 Jun 2012 11:27:53 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -101.399
X-Spam-Status: No, score=-101.399 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, J_CHICKENPOX_63=0.6, J_CHICKENPOX_66=0.6, USER_IN_WHITELIST=-100]
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id FXVAdx2W0lCZ for <>; Tue, 12 Jun 2012 11:27:52 -0700 (PDT)
Received: from ( []) by (Postfix) with ESMTP id 0A48D21F8458 for <>; Tue, 12 Jun 2012 11:27:52 -0700 (PDT)
Received: from localhost ([]:48446 ident=www-data) by with esmtp (Exim 4.77) (envelope-from <>) id 1SeVod-0007mR-EP; Tue, 12 Jun 2012 20:27:43 +0200
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 8bit
From: websec issue tracker <>
X-Trac-Version: 0.12.2
Precedence: bulk
Auto-Submitted: auto-generated
X-Mailer: Trac 0.12.2, by Edgewall Software
X-Trac-Project: websec
Date: Tue, 12 Jun 2012 18:27:43 -0000
Message-ID: <>
References: <>
X-Trac-Ticket-ID: 40
In-Reply-To: <>
X-SA-Exim-Scanned: No (on; SAEximRunCond expanded to false
Resent-Message-Id: <>
Resent-Date: Tue, 12 Jun 2012 11:27:52 -0700
Subject: Re: [websec] #40: Various editorial comments on -06
X-Mailman-Version: 2.1.12
List-Id: Web Application Security Minus Authentication and Transport <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Tue, 12 Jun 2012 18:27:53 -0000

#40: Various editorial comments on -06

  #when True - paul


 "annunciate" (used a few times) is a fancy word for "announce". Maybe use
 the far more common word instead.

 In section 3.1, "suboptimal downside" is unclear. Is there an optimal
 downside? I suggest replacing it with "negative".

 The lead sentences in sections 11.2, 11.4, and 11.5 lack verbs; verbs are
 used in 11.1 and 11.3. This should be an easy fix. - yoav


 In the introduction 2nd paragraph it says "(although modulo other rules)".
 s/modulo/subject to/.

 Also, replace "annunciate" with "announce" or "indicate".

 Both the introduction and section 8.2 say the policy applies to "all TCP
 ports". Hosts have multiple TCP ports: for SSH as an example. I suggest we
 change to "all HTTP(S) ports"

 In the title of section 8.5, I think we can do without the word

 Section 10.1 begins with "Server implementations and deploying web sites
 need to consider whether they are setting…". Searching for the alternative
 (because an implied "or not" doesn't work for this sentence) took me to
 the 4th paragraph of this section, and the top of page 21, which begins
 with "Or, whether they are setting". This won't make it past the RFC
 editor, but I think it should be rephrased earlier.

 Section 14.1 discusses a UA behind an SSL proxy and implies that such a
 connection will cause warning screens (without HSTS) or hard failures.
 Such a deployment would be considered a wrong deployment of an SSL proxy.
 Administrators usually configure the UAs that are managed, and give
 detailed instructions to the owners of UAs that are not managed, so that
 the CA used by the proxy is trusted. There should be no warnings and no
 hard failures.

 Section 1:

    This specification also incorporates notions from [JacksonBarth2008]
    in that policy is applied on an "entire-host" basis: it applies to
    all TCP ports of the issuing host.

 Please make it clear that all TCP ports does not mean all application
 protocols, only HTTP on all ports where it might be offered (not only
 the ports registered with the IANA).

 Section 7.2

 Does is make sense to mention that status code 308 might be
 appropriate in certain circumstances? See draft-reschke-http-status-308.

 Section 8.4

 The HTTP-Equiv <Meta> Element Attribute is defined in the HTML
 specification, so a reference would be helpful.

 Section 9

 The phrase "valid Unicode-encoded string-serialized domain name" seems
 a bit strange, because we don't typically refer to Unicode as an
 encoding scheme. See RFC 6365 regarding such terminology.

 Section 11.1

 I think the text about "no user recourse" conflates two things:
 showing a warning, and allowing the user to click through: "the user
 should not be presented with an explanatory dialog giving her the
 option to proceed." Would it be OK for a user agent to show an
 explanatory dialog but not provide an option to proceed? Is there a
 security reason to fail the connection without any explanation?

 Section 11.5

 The note it worded a bit oddly (e.g., "it shouldn't be possible for an
 attacker to inject script..." might be better worded along the lines
 of "implementations need to guard against alowing an attacker to
 inject script...").
    #if changes_body
Changes (by jeff.hodges@…):

 * status:  new => closed
 * resolution:   => fixed

    #if changes_descr
      #if not changes_body and not change.comment and
Description changed by jeff.hodges@…:

    #if change.comment


 fixed in -07

 Reporter:               |       Owner:  draft-ietf-websec-strict-
  jeff.hodges@…          |  transport-sec@…
     Type:  defect       |      Status:  closed
 Priority:  minor        |   Milestone:
Component:  strict-      |     Version:
  transport-sec          |  Resolution:  fixed
 Severity:  In WG Last   |
  Call                   |
 Keywords:               |

Ticket URL: <>
websec <>