Subject: Re: [apps-discuss] AppsDir Review of draft-ietf-appsawg-acct-uri-03

From: Dave Cridland <[email-masked]>
Date: Wed, 27 Mar 2013 08:47:35 +0000

Thanks. This completely satisfies my comments.
On 27 Mar 2013 02:02, "Peter Saint-Andre" <[email-masked]> wrote:

> On Mar 11, 2013, at 9:38 AM, Dave Cridland wrote:
>
> I have been selected as the Applications Area Directorate reviewer for
> this draft (for background on appsdir, please see
> http://trac.tools.ietf.org/area/app/trac/wiki/ApplicationsAreaDirectorate).
>
> Please resolve these comments along with any other Last Call comments you
> may receive. Please wait for direction from your document shepherd or AD
> before posting a new version of the draft.
> Document: draft-ietf-appsawg-webfinger-11
> Title: The 'acct' URI Scheme
> Reviewer: Dave Cridland
> Review Date: 2013/03/11
>
> Summary: Ready for publication as Standards Track. Although I note one
> possible additional security consideration it is minor.
>
> Editorial Comments:
>
> 1) I do love the use of "discussants", but I hesitantly wonder if the more
> common (if less specific) "participants" would be a more readily understood
> choice of word?
>
>
> I'll change it "the participants in that discussion".
>
> Minor Comments:
>
> 1) I note that an acct scheme URI provides proof of existence of the
> account; this implies that harvesting published acct URIs would be useful
> for spammers and similar attackers, if they can also use this to leverage
> more information about the account (such as via WebFinger).
>
>
> Good point. I'll add text to the Security Considerations on this point
> (expect a revised I-D at some point in the near future).
>
> Peter
>
>
>

---

From: Peter Saint-Andre <[email-masked]>
Date: Tue, 26 Mar 2013 20:02:17 -0600

On Mar 11, 2013, at 9:38 AM, Dave Cridland wrote:

> I have been selected as the Applications Area Directorate reviewer  
> for this draft (for background on appsdir, please see http://trac.tools.ietf.org/area/app/trac/wiki/ApplicationsAreaDirectorate 
>  ).
>
> Please resolve these comments along with any other Last Call  
> comments you may receive. Please wait for direction from your  
> document shepherd or AD before posting a new version of the draft.
> Summary: Ready for publication as Standards Track. Although I note  
> one possible additional security consideration it is minor.
>
> Editorial Comments:
>
> 1) I do love the use of "discussants", but I hesitantly wonder if  
> the more common (if less specific) "participants" would be a more  
> readily understood choice of word?

> account; this implies that harvesting published acct URIs would be  
> useful for spammers and similar attackers, if they can also use this  
> to leverage more information about the account (such as via  
> WebFinger).

Peter