Subject: Re: [websec] WGLC feedback for X-Frame-Options

From: Tobias Gondrom <[email-masked]>
Date: Sat, 22 Jun 2013 14:10:21 +0800

Dear websec fellows,

I just uploaded the latest version of XFO including the WGLC feedback I
received.
(Apologies for the delay, this happened due to some personal difficulties.)

I hope the new revision is satisfactory and we can go to IETF LC.
The changes were only very small:
- the "deprecation of X-" comment is in the introduction section incl.
reference to 6648
- and I removed the section 2.2.2 as recommended by Julian.

Best regards, Tobias

On 09/11/12 03:28, Tobias Gondrom wrote:
> On 08/11/12 14:22, Barry Leiba wrote:
>>> I suggest an explicit statement such as..
>>>
>>>    The purpose of this specification is to document existing practice.
>>>
>>> ..should appear in the abstract and the intoduction.
>> ...
>>> I wonder if also a note will be necessary to explain the use of the
>>> "X-"
>>> prefix in light of...
>>>
>>> 6648 Deprecating the "X-" Prefix and Similar Constructs in Application
>>>       Protocols. P. Saint-Andre, D. Crocker, M. Nottingham. June 2012.
>> These are, of course, related, and one statement can cover both.  I
>> can pretty much guarantee you'll get DISCUSSes from the IESG if you
>> don't do it.
>
> Thank you Jeff for reminding me. Forgot to include them.
> Well, as we already have PSA's RFC on that (which btw. inspired XFO,
> both (comment and reference) have been added to the text of working
> copy (released in next version after this week).
>
>
>>
>> Barry, as AD
>> _______________________________________________
>> websec mailing list
>> [email-masked]
>> https://www.ietf.org/mailman/listinfo/websec
>
> _______________________________________________
> websec mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/websec

---

From: Julian Reschke <[email-masked]>
Date: Tue, 25 Jun 2013 10:49:42 +0200

> - and I removed the section 2.2.2 as recommended by Julian.

Thanks.

A few nits:

In 2.2, I'd replace

    The RFC 5234 [RFC5234] ABNF of the X-Frame-Options header is:

by

    The RFC 5234 [RFC5234] ABNF of the X-Frame-Options header field 
value is:

(emphasis on *value*)

(Also fix remaining instances of "header" to say "header field" for 
consistency).

In the appendices, please fix the W3C references to include the author 
names and the publication status, see 
<http://greenbytes.de/tech/webdav/rfc2629xslt/w3c-references.html#ref-CR-CSP-20121115> 
and 
<http://greenbytes.de/tech/webdav/rfc2629xslt/w3c-references.html#ref-WD-CSP11-20130604>.

Best regards, Julian

---

From: Tobias Gondrom <[email-masked]>
Date: Fri, 28 Jun 2013 16:19:19 +0800

Hi Julian,

thanks a lot!
Just uploaded the revised version correcting your two nits.

Best regards, Tobias

> (Also fix remaining instances of "header" to say "header field" for

Fixed the existing instance.
But I went through all the other instances and did not fix the remaining
instances, because most of them were semantically referring to the
header itself and not the specific field value and secondly some of them
were using the term "header field" which I believe captures the semantic
of the particular sentences appropriately. But let me know which
instance you think should be corrected as well.

> <http://greenbytes.de/tech/webdav/rfc2629xslt/w3c-references.html#ref-WD-CSP11-20130604>.

Thanks. I corrected the refs. And I guess we will also revisit the
reference links before publication in case there are any updates.

Best regards, Tobias