Subject: [Ietf-calsify] Re: status of RFC 2445bis: AD Issue #2: DIR parameter

From: Bernard Desruisseaux <[email-masked]>
Date: Mon, 06 Oct 2008 11:20:33 -0400

Eliot Lear wrote:

> AD Issue 2:
> 
> There needs to be a statement as to what URIs are allowed and how they 
> are to be resolved (in the case of HTTP and HTTPs).

I propose to change:

   The parameter value is a URI.

to:

   The parameter value SHOULD be a CID [RFC2392], DATA [RFC2397],
   FILE [RFC1738], FTP [RFC1738], HTTP [RFC2616], HTTPS [RFC2818],
   LDAP [RFC4516], or MID [RFC2392] URI.

in section 3.2.6. Directory Entry Reference.

Cheers,
Bernard
_______________________________________________
Ietf-calsify mailing list
[email-masked]
http://lists.osafoundation.org/mailman/listinfo/ietf-calsify

---

From: Bernard Desruisseaux <[email-masked]>
Date: Mon, 06 Oct 2008 11:51:49 -0400

Eliot Lear wrote:
> AD Issue 4:
> 
> Bernard has requested text, but there is consensus that text is needed 
> and we are currently blocking on that.

I propose to add the following sentence, proposed by Lisa, at the end of 
section 3.6. Calendar Components:

  Applications that support importing iCalendar objects SHOULD
  support all of the component types defined in this document,
  and SHOULD NOT silently drop any components as that can lead
  to user data loss.

Cheers,
Bernard

---

From: Cyrus Daboo <[email-masked]>
Date: Thu, 16 Oct 2008 12:39:27 -0400

Hi Bernard,

> in section 3.2.6. Directory Entry Reference.

OK, but I would drop the file: URL as that has been used as a vector for 
attack (e.g. send me file:/etc/passwd) - and it really only makes sense to 
one person anyway.

I also think we should add a sentence to security considerations to 
re-emphasize the fact that use of URLs is subject to additional issues:

"This specification includes several places where URLs are used to 
represent data that is expected to be accessed via the URL. In each case 
the security considerations pertaining to the URL scheme MUST be adhered 
to."

-- 
Cyrus Daboo

_______________________________________________
ietf-calsify mailing list
[email-masked]
http://lists.osafoundation.org/mailman/listinfo/ietf-calsify

---

From: Cyrus Daboo <[email-masked]>
Date: Thu, 16 Oct 2008 12:40:20 -0400

Hi Bernard,

>   and SHOULD NOT silently drop any components as that can lead

Looks OK.

-- 
Cyrus Daboo

---

From: Reinhold Kainhofer <[email-masked]>
Date: Fri, 17 Oct 2008 01:44:05 +0200

> attack (e.g. send me file:/etc/passwd) - and it really only makes sense to

Or to a whole working group if it refers to a file on a share drive. In these 
circumstances, file:// makes a lot of sense.

Cheers,
Reinhold

- -- 
- ------------------------------------------------------------------
Reinhold Kainhofer, Vienna University of Technology, Austria
email: [email-masked], http://reinhold.kainhofer.com/
 * Financial and Actuarial Mathematics, TU Wien, http://www.fam.tuwien.ac.at/
 * K Desktop Environment, http://www.kde.org, KOrganizer maintainer
 * Chorvereinigung "Jung-Wien", http://www.jung-wien.at/
_______________________________________________
ietf-calsify mailing list
[email-masked]
http://lists.osafoundation.org/mailman/listinfo/ietf-calsify