Subject: [secdir] Secdir review: draft-west-webappsec-csp-reg-03.txt

From: Robert Sparks <[email-masked]>
Date: Fri, 16 Oct 2015 14:04:22 -0500

I have reviewed this document as part of the security directorate's
ongoing effort to review all IETF documents being processed by the
IESG.  These comments were written primarily for the benefit of the
security area directors.  Document editors and WG chairs should treat
these comments just like any other last call comments.

Summary: Ready for publication as Informational

This draft establishes a registry (specification required/expert 
review), and populates it with an initial set of values defined in and 
used by a w3c specification that is security-centric. Creating the 
registry introduces no new security concerns itself.

One thing (not particularly security related) to consider:

The BNF for directive-name, as copied into this draft, allows a 
directive name of -, or --, ---, etc.
Are you expecting an expert to disallow these, or are they ok?
Is the answer the same for the name 42?

---

From: Mike West <[email-masked]>
Date: Tue, 20 Oct 2015 11:37:06 +0200

> these comments just like any other last call comments.

Thank you, Robert!

> The BNF for directive-name, as copied into this draft, allows a directive
> name of -, or --, ---, etc.

I think we would rely on the expert to determine whether these are
appropriate directive names. I'd suggest that they aren't, but I'm not
sure it's worth constructing a more rigid grammar which would ban
them.

-mike