Subject: [httpapi] Roman Danyliw's No Objection on draft-ietf-httpapi-linkset-08: (with COMMENT)

From: Roman Danyliw via Datatracker <[email-masked]>
Date: Wed, 02 Mar 2022 08:06:09 -0800

Roman Danyliw has entered the following ballot position for
draft-ietf-httpapi-linkset-08: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/about/groups/iesg/statements/handling-ballot-positions/ 
for more information about how to handle DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-httpapi-linkset/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Thank you to Donald Eastlake for the SECDIR review.

** Section 4.2.  Given that there is normative guidance around
[W3C.REC-json-ld-20140116], please make this reference normative.

** Section 7.4. Editorial.  There are a few examples using live, non-example
domains (e.g., Figure 14 with
“https://dalgiardino.com/risotto-rice-with-mushrooms/” ).

** Section 9.  Thanks for citing the Security Considerations of [RFC8288]. 
Please also add the more generic ones of (Section 7 of) RFC3986.

** Section 9.  As an extension of the idea of links having context, should
caution be provided about mixed content (link file or headers is sent over
HTTPS but contain HTTP links)?

---

From: Herbert Van de Sompel <[email-masked]>
Date: Wed, 9 Mar 2022 12:07:45 +0100

hi Roman,

Your comments were addressed either by edits to the I-D or by feedback
provided below under "Response". New I-D version at
https://github.com/ietf-wg-httpapi/linkset/blob/master/draft-ietf-httpapi-linkset-09.xml

Greetings

Herbert

===================

Response: fixed in the I-D

Response:
- We are not dealing with mixed content because resources involved in links
contained in a linkset are not loaded/rendered when retrieving the link
set. It is the loading/rendering that generates security concerns. See,
e.g. https://web.dev/what-is-mixed-content/
- A linkset that is obtained over https can contain links with http
resources. But for those, as for all other links, the caution expressed in
the I-D regarding consuming links in general applies.

Response: This

** Section 7.4. Editorial.  There are a few examples using live,
non-example domains (e.g., Figure 14 with “
https://dalgiardino.com/risotto-rice-with-mushrooms/” ).

Response: fixed in the I-D

===================

On Wed, Mar 2, 2022 at 5:06 PM Roman Danyliw via Datatracker <
[email-masked]> wrote:

> Please refer to
> https://www.ietf.org/about/groups/iesg/statements/handling-ballot-positions/
> --
> httpapi mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/httpapi
>

-- 
==================
Herbert Van de Sompel
https://hvdsomp.info
https://orcid.org/0000-0002-0715-6126