Re: [websec] Comments on draft-abarth-principles-of-origin-00, was: Reviews of draft-ietf-websec-origin and principles-of-origin until end of May

[Tobias Gondrom <[e-mail]>]

Hi Adam,

FWIW my opinion is in favour of merging the two.
Reasons:
1. principles is rather short and gives a good context and introduction 
to origin, so it seems appropriate to merge them both together.
2. if I would consider origin referencing principles, there might be a 
larger number of references, which again I would take as a sign that 
merging them might be the right thing to do.
3. I tend to disagree with Jeff's argument that future references of 
"principles" would be a good reason to keep both drafts separate. I 
believe in this case future work can equally reference from the origin 
draft.

Kind regards and looking forward to reading the new version.

Tobias



On 16/06/11 04:59, Adam Barth wrote:
> I was hoping other folks would weigh into the thread.  In the interest
> of moving forward, I'm going to combine them into one document but try
> to structure the document so that folks who aren't interested in the
> nuts and bolts can still get the high-level picture.  Most of the
> folks who want to refer to the Principles document probably also want
> to refer to the Nuts-and-Bolts doc, so having them together makes that
> easier.
>
> The main tricky thing I'm working on at the moment is the scope /
> perspective issue.  Once I get that hammered out (either tonight or
> tomorrow), I'll upload a new draft.
>
> Thanks,
> Adam
>
>
> On Mon, Jun 13, 2011 at 1:41 PM, =JeffH<[e-mail]>  wrote:
>> Julian asked:
>>
>>> I believe that having two documents make sense; what's the benefit of
>>> merging?
>> Yes, I have the same question now (after belatedly reviewing the document in
>> more detail). I'm thinking Principles of the Same-Origin Policy (PSOP) ought
>> to be a separate doc, because it'll get referenced down the road
>> specifically
>> for this principle stuff, possibly by a wider range of docs than would
>> reference the Origin header spec (which concerns a particular concrete facet
>> of web platform machinery).
>>
>> I also think (on an admittedly quick re-skim) John Kemp's so-called "scope"
>> comments are overall apropos -- I have many of the same thoughts..
>>
>>   Re: [websec] Principles of the Same-Origin Policy
>>   http://www.ietf.org/mail-archive/web/websec/current/msg00257.html
>>
>> You (Adam B) are writing from the perspective of one steeped in browser and
>> web application internals, and seemingly for a similar audience it seems.
>> However, I suspect this doc would likely get read by a wider audience,
>> including those who are trying to learn (or write) about how this complex
>> "web platform" beast works.
>>
>> HTH,
>>
>> =JeffH
>>
>> _______________________________________________
>> websec mailing list
>> [e-mail]
>> https://www.ietf.org/mailman/listinfo/websec
>>
> _______________________________________________
> websec mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/websec