Subject: Re: [secdir] draft-ietf-appsawg-json-pointer-07 SECDIR Review

From: Mark Nottingham <[email-masked]>
Date: Wed, 2 Jan 2013 15:12:35 +1100

Thanks for the review; replies below.

On 31/12/2012, at 2:11 PM, Donald Eastlake <[email-masked]> wrote:

> I have reviewed this document as part of the security directorate's
> ongoing effort to review all IETF documents being processed by the
> IESG.  Document editors and WG chairs should treat these comments just
> like any other last call comments.
> 
> This draft describes two closely related syntaxes for pointers to
> objects within a JSON (JavaScript Object Notation) document. One is a
> JSON string syntax, the other is a URI fragment identifier for URIs
> defined to take such a fragment identifier.
> 
> Security:
> 
> I do not see any security problems with this document. The syntax
> appears to be unambiguously specified, including ABNF, and the
> Security Considerations Section is adequate and touches on the
> potential pit-falls that JSON pointers can contain NULs.
> 
> Miscellaneous:
> 
> I found significant ambiguity in the semantics of a JSON pointer
> string. Is the result of the successful evaluation ("evaluation" is a
> term used in the draft) of such a pointer string a structure that
> points into a JSON document or is it the objection pointed to? It
> mostly seems to be an object but it is specifically provided that
> array references could point beyond the end of an array and at least
> in that case perhaps some sort of pointer structure would be returned
> with the error condition. It probably doesn't matter, because these
> syntaxes are intended to be used in a variety of applications and it
> will be up to the application to clarify the semantics.

I think it's purposefully ambiguous, to accommodate a variety of applications.

> Minor:
> 
> The expansion for the acronym JSON should be given in the title and abstract.

In SVN.

> In the first line of the second paragraph of Section 6, I found the
> word "nominate" kind of odd. Why not "specify" or "select" or "use"?

In SVN.

> None of the Authors Addresses given includes a postal address.

Yes.

--
Mark Nottingham   http://www.mnot.net/

---

From: Donald Eastlake <[email-masked]>
Date: Wed, 2 Jan 2013 00:18:19 -0500

Hi Mark,

> I think it's purposefully ambiguous, to accommodate a variety of applications.

OK.

>> The expansion for the acronym JSON should be given in the title and abstract.

What does that mean? If you mean to say that you agree with the change
suggested and that it will be in the next version posted, you should
say that.

>> word "nominate" kind of odd. Why not "specify" or "select" or "use"?

Same response as above.

>> None of the Authors Addresses given includes a postal address.

I think they should. I find that such corner cutting typically goes
with other sloppiness.

Thanks,
Donald
=============================
 Donald E. Eastlake 3rd   +1-508-333-2270 (cell)
 155 Beaver Street, Milford, MA 01757 USA
 [email-masked]

---

From: Mark Nottingham <[email-masked]>
Date: Wed, 2 Jan 2013 16:20:25 +1100

> suggested and that it will be in the next version posted, you should

It does. Could it mean something else, I wonder?

> I think they should. I find that such corner cutting typically goes

Alternatively, it could mean that the authors don't wish to expose their postal addresses. Or, that they believe that their electronic addresses will be more stable than physical ones.

---

From: Barry Leiba <[email-masked]>
Date: Wed, 2 Jan 2013 09:33:06 -0500

> Alternatively, it could mean that the authors don't wish to expose their postal
> addresses. Or, that they believe that their electronic addresses will be more
> stable than physical ones.

I agree; we should drop this item from any discussion.  The custom of
putting at least one postal address is an old one, and might be
considered "quaint" by some now.  It's rare, indeed, for anyone to try
to contact an author by postal mail.  (The same, by the way, goes for
phone numbers: in this case there are phone numbers for some authors,
but I have no issue with having none.)

Barry, responsible AD