9570 2010-04-21 12:28:53 +0000 MEX: "Security Considerations" sections vague and misleading 2010-07-28 09:12:10 +0000 1 1 1 Unclassified WS-Resource Access MetadataExchange LC PC All CLOSED REMIND P2 normal --- 1 bob gilbert.pilz dug public-ws-resource-access-notifications oldest_to_newest 35182 0 bob 2010-04-21 12:28:53 +0000 WS-Eventing, WS-Transfer, WS-MetadataExchange, and WS-Enumeration each contain a "Security Considerations" section. These sections contain various bits of "pious advice" that have no normative value and little to do with the protocols to which they apply. If you understand the basics of web services security, these sections won't teach you anything new and don't provide any insight into the particular problems of securing their corresponding protocols. For example, the Security Considerations section of WS-Eventing says nothing about making sure that the sender of a Renew, GetStatus, or Unsubscribe request is the same entity as the sender of the Subscribe request that created the subscription that is being acted upon. Proposal 1: remove the "Security Considerations" sections from WS-Eventing, WS-Transfer, WS-MetadataExchange, and WS-Enumeration. Proposal 2: rewrite the "Security Considerations" sections from WS-Eventing, WS-Transfer, WS-MetadataExchange, and WS-Enumeration along the following guidelines: 1. Identify the specific resources that need to be protected (e.g. subscriptions, enumeration contexts, etc.) 2. Describe common methods for protecting these resources including, but not limited to, the use of WS-Security and related technologies. Relate these methods to the protocol in question. 3. Identify any special challenges posed to (2) due to the nature of the protocols, etc. 35551 1 bob 2010-05-11 11:01:10 +0000 proposal at http://lists.w3.org/Archives/Public/public-ws-resource-access/2010May/0017.html 35558 2 bob 2010-05-11 16:22:55 +0000 resolved as proposed in message linked in comment #1