Subject: [dispatch] Éric Vyncke's No Objection on draft-ietf-dispatch-javascript-mjs-12: (with COMMENT)

From: Éric Vyncke via Datatracker <[email-masked]>
Date: Mon, 03 Jan 2022 04:16:01 -0800

Éric Vyncke has entered the following ballot position for
draft-ietf-dispatch-javascript-mjs-12: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/blog/handling-iesg-ballot-positions/
for more information about how to handle DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-dispatch-javascript-mjs/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Thank you for the work put into this document.

Please find below ssome non-blocking COMMENT points (but replies would be
appreciated even if only for my own education), and some nits.

Special thanks to Ben Campbell for the shepherd's write-up including the
section about the WG consensus for this update and on RFC 4329.

I hope that this helps to improve the document,

Regards,

-éric

== COMMENTS ==

-- Section 3 --

Is TC39 so well-known by the IETF community that no expansion/explanation is
required?

-- Section 5 --
This security section is pretty extensive (good thing) and I wonder whether it
is relevant to this document as it is not related to the media types themselves
but more on the scripting language itself.

== NITS ==

-- Section 4.2 --
Suggestion, add "else" on steps 2 and 3 to be clear.

---

From: Mathias Bynens <[email-masked]>
Date: Mon, 3 Jan 2022 13:43:14 +0100

Thanks for taking a look, Éric. On behalf of the authors, I’ll respond to
your comments inline:

> https://datatracker.ietf.org/doc/draft-ietf-dispatch-javascript-mjs/

TC39 is the standards body in charge of ECMAScript, a.k.a. the JavaScript
language. The only mention of “TC39” in the draft gives the following
context:

```
   The TC39 standards body for ECMAScript has determined that media
   types are outside of their scope of work [TC39-MIME-ISSUE].
```

What would you consider to be missing? Happy to expand on this.

> but more on the scripting language itself.

Two notes:

1. The security section builds upon the one from RFC4329 (
https://datatracker.ietf.org/doc/html/rfc4329#section-5) which our draft
aims to supersede. Removing it would be a regression.
2. I see your point — the security risks are *mostly* related to the
language. IMHO the security section is still worth including, as for e.g.
browser implementations, the MIME type is what determines whether a given
resource is processed as a script or not. Thus, failing to respect the
media types as stated (e.g. accepting additional, non-standard media types
as if they were JavaScript) would constitute a security risk.

== NITS ==
> Suggestion, add "else" on steps 2 and 3 to be clear.

This section was inherited from RFC4329 as-is, and we’ve been hesitant to
make changes to it. However, this change seems small and harmless enough,
so I’ve prepared a patch here:
https://github.com/linuxwolf/bmeck-ids/pull/59

---

From: "Eric Vyncke (evyncke)" <[email-masked]>
Date: Mon, 3 Jan 2022 13:04:07 +0000

Thank you, Mathias, for your prompt reply.

About the TC39 point, may I suggest the text "The ECMA Technical Committee 29 (TC29), the standards body for ECMAscript, has determined..." ?

All other remarks accepted.

Regards

-éric

From: Mathias Bynens <[email-masked]>
Date: Monday, 3 January 2022 at 13:43
To: Eric Vyncke <[email-masked]>
Cc: The IESG <[email-masked]>, "[email-masked]" <[email-masked]>, dispatch chairs <[email-masked]>, DISPATCH WG <[email-masked]>, Ben Campbell <[email-masked]>
Subject: Re: Éric Vyncke's No Objection on draft-ietf-dispatch-javascript-mjs-12: (with COMMENT)

Thanks for taking a look, Éric. On behalf of the authors, I’ll respond to your comments inline:

On Mon, Jan 3, 2022 at 1:16 PM Éric Vyncke via Datatracker <[email-masked]<mailto:[email-masked]>> wrote:
Éric Vyncke has entered the following ballot position for
draft-ietf-dispatch-javascript-mjs-12: No Objection

Regards,

-éric

== COMMENTS ==

-- Section 3 --

TC39 is the standards body in charge of ECMAScript, a.k.a. the JavaScript language. The only mention of “TC39” in the draft gives the following context:

```

-- Section 5 --

Two notes:

1. The security section builds upon the one from RFC4329 (https://datatracker.ietf.org/doc/html/rfc4329#section-5) which our draft aims to supersede. Removing it would be a regression.
2. I see your point — the security risks are *mostly* related to the language. IMHO the security section is still worth including, as for e.g. browser implementations, the MIME type is what determines whether a given resource is processed as a script or not. Thus, failing to respect the media types as stated (e.g. accepting additional, non-standard media types as if they were JavaScript) would constitute a security risk.

== NITS ==

-- Section 4.2 --

This section was inherited from RFC4329 as-is, and we’ve been hesitant to make changes to it. However, this change seems small and harmless enough, so I’ve prepared a patch here: https://github.com/linuxwolf/bmeck-ids/pull/59

---

From: Mathias Bynens <[email-masked]>
Date: Mon, 3 Jan 2022 14:27:52 +0100

Thank you! Patch amended:
https://github.com/linuxwolf/bmeck-ids/pull/59/files I’ll land this and
will cut a new draft version including these changes.

On Mon, Jan 3, 2022 at 2:04 PM Eric Vyncke (evyncke) <[email-masked]>
wrote:

> About the TC39 point, may I suggest the text "The ECMA Technical Committee
> 29 (TC29), the standards body for ECMAscript, has determined..." ?
>
>
>
> *From: *Mathias Bynens <[email-masked]>
> *Date: *Monday, 3 January 2022 at 13:43
> *To: *Eric Vyncke <[email-masked]>
> *Cc: *The IESG <[email-masked]>, "
> [email-masked]" <
> [email-masked]>, dispatch chairs <
> [email-masked]>, DISPATCH WG <[email-masked]>, Ben Campbell <
> [email-masked]>
> *Subject: *Re: Éric Vyncke's No Objection on
> draft-ietf-dispatch-javascript-mjs-12: (with COMMENT)
>
>
>
> On Mon, Jan 3, 2022 at 1:16 PM Éric Vyncke via Datatracker <
> [email-masked]> wrote:
>

---

From: John C Klensin <[email-masked]>
Date: Mon, 03 Jan 2022 09:29:11 -0500

--On Monday, January 3, 2022 13:04 +0000 "Eric Vyncke (evyncke)"
<evyncke=[email-masked]> wrote:

> About the TC39 point, may I suggest the text "The ECMA
> Technical Committee 29 (TC29), the standards body for
> ECMAscript, has determined..." ?

s/29/39/ above

Especially since there is an ISO TC 39, which is in a very
different business (Machine Tools) and confusion is potentially
possible, I want to strongly reinforce this.  Because there are
other such cases, including national bodies that use "TC
designations", I think it would be helpful to have a general
guideline that TC NN is never used without explicit
identification of the parent organization.

best,
   john

---

From: Mathias Bynens <[email-masked]>
Date: Mon, 3 Jan 2022 18:51:05 +0100

The phrasing I used in my patch was:

"Ecma International's Technical Committee 39 (TC39), the standards body in
charge of ECMAScript, has determined that media types are outside of their
scope of work {{TC39-MIME-ISSUE}}."

---

From: John C Klensin <[email-masked]>
Date: Tue, 04 Jan 2022 01:47:34 -0500

--On Monday, January 3, 2022 18:51 +0100 Mathias Bynens
<[email-masked]> wrote:

> "Ecma International's Technical Committee 39 (TC39), the
> standards body in charge of ECMAScript, has determined that
> media types are outside of their scope of work
> {{TC39-MIME-ISSUE}}."

IIR, Ecma International might prefer 

	Ecma International's Technical Committee 39 (Ecma TC39)

As another alternative, you might check with the RFC Editor
Staff as to whether they think "Ecma" is a well-known
abbreviation (like "ISO", etc.).  If so, you could just say
"Ecma TC39"  and save the additional words.

But your version is almost certainly good enough.

   john