Subject: PaceFormatSecurity

From: Robert Sayre <[email-masked]>
Date: Mon, 07 Feb 2005 13:35:39 -0500

-1. Covers HTML in too much detail, though it's still inadequate 
coverage. This is isn't our problem. I blame the W3C :)

Robert Sayre

---

From: Paul Hoffman <[email-masked]>
Date: Mon, 7 Feb 2005 11:21:34 -0800

-1. If the current security documents that cover the material are 
insufficient, they should be fixed, and not have it listed in our 
document. We should only point to where generic information can be 
found and list things that are Atom-specific.

--Paul Hoffman, Director
--Internet Mail Consortium

---

From: Sam Ruby <[email-masked]>
Date: Mon, 07 Feb 2005 14:35:19 -0500

> coverage. This is isn't our problem. I blame the W3C :)

I'm +1 on the pace, particularly now that the prescriptive text has been 
removed.

It seems to me that we have an obligation to either (1) disallow HTML, 
or (2) mitigate allowing HTML by providing a security section such as 
this one.

If (2) can be solved by reference, then that clearly would be preferred. 
  But to date, no such reference has been found.

- Sam Ruby

---

From: Robert Sayre <[email-masked]>
Date: Mon, 07 Feb 2005 15:02:56 -0500

>  But to date, no such reference has been found.

So, engaging in bad specification practice[0] is the answer? HTML 
security is a problem for the W3C and/or an HTML-WG. Existing RFCs 
constitute the IETF's definition of adequate security coverage for HTML. 
  If we want to change the status quo in our document, we need to say 
that we're updating those RFCs at the top of our document.

Robert Sayre

[0] http://www.imc.org/atom-syntax/mail-archive/msg12625.html

---

From: Graham <[email-masked]>
Date: Mon, 7 Feb 2005 20:01:35 +0000

-1, agree with Robert.

Graham