Subject: Re: [websec] Pete Resnick's No Objection on draft-ietf-websec-x-frame-options-09: (with COMMENT)

From: Barry Leiba <[email-masked]>
Date: Wed, 14 Aug 2013 18:15:35 -0400

> Why is this document not on the standards track?

Because it's not anything we want to tell people to start implementing
now.  We want them to move toward the work we transferred over to
W3C's WebAppSec group instead.

b

---

From: "Pete Resnick" <[email-masked]>
Date: Wed, 14 Aug 2013 15:12:50 -0700

Pete Resnick has entered the following ballot position for
draft-ietf-websec-x-frame-options-09: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to http://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
http://datatracker.ietf.org/doc/draft-ietf-websec-x-frame-options/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

---

From: Pete Resnick <[email-masked]>
Date: Wed, 14 Aug 2013 22:21:32 -0500

> W3C's WebAppSec group instead.

It's probably worth having a line to that effect somewhere in the document.

pr

-- 
Pete Resnick<http://www.qualcomm.com/~presnick/>
Qualcomm Technologies, Inc. - +1 (858)651-4478

---

From: Tobias Gondrom <[email-masked]>
Date: Sat, 17 Aug 2013 19:57:34 +0100

On 14/08/13 23:15, Barry Leiba wrote:
> _______________________________________________
> websec mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/websec

Barry is correct.

Best regards, Tobias

---

From: Tobias Gondrom <[email-masked]>
Date: Sat, 17 Aug 2013 20:23:32 +0100

> It's probably worth having a line to that effect somewhere in the
We do have a respective text in the introduction:
"This specification provides informational documentation about the
current use and definition of the X-Frame-Options HTTP header field. As
described in Section 2.3.2.2 not all browsers implement X-Frame-Options
exactly in the sames way, which can lead to unintended results. And
given that the "X-" construction is deprecated [RFC6648], the
X-Frame-Options header field will in the future be replaced by the
Frame-Options directive in the Content Security Policy Version 1.1
[CSP-1-1]"

Best regards, Tobias