Subject: [secdir] secdir review of draft-cdmi-mediatypes

From: Tom Yu <[email-masked]>
Date: Thu, 09 Dec 2010 23:39:22 -0500

This document does not appear to introduce any significant security
concerns of its own.  I suggest that the Security Considerations
section additionally mention the JSON-related security considerations
in RFC 4627.

---

From: "Krishna Sankar (ksankar)" <[email-masked]>
Date: Thu, 9 Dec 2010 21:04:52 -0800

Tom,
	The security considerations in RFC 4627 pertains to JavaScript
and security pertaining to scripting languages. We are not using
JavaScript in CDMI and so that section is not relevant here.
Cheers
<k/>

-----Original Message-----
From: Tom Yu [mailto:[email-masked]] 
Sent: Thursday, December 09, 2010 8:39 PM
To: [email-masked]; [email-masked];
[email-masked]
Subject: secdir review of draft-cdmi-mediatypes

---

From: Tom Yu <[email-masked]>
Date: Fri, 10 Dec 2010 13:33:44 -0500

> JavaScript in CDMI and so that section is not relevant here.

Section 3.1 of your document says that the CDMI interface represents
CDMI objects in JSON format.  If some element of some CDMI
implementation is written (perhaps ill-advisedly) in JavaScript and
chooses to use eval() to parse the JSON encoding, then I believe the
Security Considerations of RFC 4627 would apply.

---

From: "Krishna Sankar (ksankar)" <[email-masked]>
Date: Sat, 11 Dec 2010 20:59:56 -0800

New version posted http://www.ietf.org/id/draft-cdmi-mediatypes-04.txt

Cheers & thanks
<k/>

-----Original Message-----
From: Tom Yu [mailto:[email-masked]] 
Sent: Friday, December 10, 2010 10:34 AM
To: Krishna Sankar (ksankar)
Cc: [email-masked]; [email-masked];
[email-masked]
Subject: Re: secdir review of draft-cdmi-mediatypes