Subject: AS#2: some minor bits of English

From: "Paul V Ford-Hutchinson" <[email-masked]>
Date: Fri, 19 Apr 2002 16:09:32 +0100

A few nits

in as2-10 ...

- page 5 (seems to be page 5 in -11 pre-draft too)

"    Many of the specifications referenced by [MIME-TYPES] were
    designed for SMTP transports. Implementors are advised to make
    appropriate adjustments for HTTP transport as indicated in
    section 4 of this document."

'this document' is ambiguous - I went looking in the draft and not the 
reference.

- section 2.4 last few lines (seems to be section 2.3 in the -11 
pre-draft)

"making use of the HTTPS scheme to obtain security privacy."

'security privacy' is not English

- bottom of page 14 (middle of page 15 in -11 pre-draft)

"    Otherwise the automated acknowledgement semantics are left open
    to further semantic specification by specific electronic commerce"

semantic overload ?

-section 3.2.4 (both docs)

As https is recommended - should there not be some discussion of the TLS 
multi-hosting problem (X.509 DN in cert vs HOST parm in HTTP)

Cheers,
Paul

--
Paul Ford-Hutchinson :  eCommerce application security : 
[email-masked]
MPT-6, IBM , PO Box 31, Birmingham Rd, Warwick, CV34 5JL +44 (0)1926 
462005
http://www.ford-hutchinson.com/~fh-1-pfh/ftps-ext.html

---

From: "David Fischer" <[email-masked]>
Date: Fri, 19 Apr 2002 17:56:05 -0500

I adjusted the AS2 draft to address all but the last
comment.  This issue of system identification through a name
in the certificate is a hotly debated issue.  I think we
could get in trouble no matter what we say.  Since this is
really outside the scope of AS2, I didn't change anything.
Suggestions?  In the interoperability tests, we
allow/encourage the domain name check but we have found we
cannot require it.

Regards,

David Fischer
Drummond Group.
  -----Original Message-----
  From: [email-masked]
[mailto:[email-masked]]On Behalf Of Paul V
Ford-Hutchinson
  Sent: Friday, April 19, 2002 10:10 AM
  To: [email-masked]
  Subject: AS#2: some minor bits of English

  A few nits

  in as2-10 ...

  "    Many of the specifications referenced by [MIME-TYPES]
were
      designed for SMTP transports. Implementors are advised
to make
      appropriate adjustments for HTTP transport as
indicated in
      section 4 of this document."

  'this document' is ambiguous - I went looking in the draft
and not the reference.

  - section 2.4 last few lines (seems to be section 2.3 in
the -11 pre-draft)

  "making use of the HTTPS scheme to obtain security
privacy."

  "    Otherwise the automated acknowledgement semantics are
left open
      to further semantic specification by specific
electronic commerce"

  semantic overload ?

  As https is recommended - should there not be some
discussion of the TLS multi-hosting problem (X.509 DN in
cert vs HOST parm in HTTP)

  Cheers,
  Paul

  --
  Paul Ford-Hutchinson :  eCommerce application security :
[email-masked]
  MPT-6, IBM , PO Box 31, Birmingham Rd, Warwick, CV34 5JL
+44 (0)1926 462005
  http://www.ford-hutchinson.com/~fh-1-pfh/ftps-ext.html