Call for Consensus (CfC) to close the Web Intents Task Force - Deadline October 29, 2015

2015-10-15 Thread Frederick Hirsch
, 2015 (2 weeks) to this CfC. Thanks regards, Frederick Frederick Hirsch Chair, W3C Device APIs WG (DAP) www.fjhirsch.com @fjhirsch [1] http://www.w3.org/2009/dap/#webintents [2] http://w3c.github.io/dap-charter/DeviceAPICharter.html [3] http://www.w3.org/2015/10/webplatform-charter.html

Call for Consensus to Publish First Public Working Draft of FindText API completed with support and no objections

2015-10-14 Thread Frederick Hirsch
6, 2015, at 4:32 PM, Frederick Hirsch wrote: > > This is a call for consensus (CfC) to publish a First Public Working Draft > (FPWD) of FindText API; deadline 14 October (1 week) > > This FindText API is joint deliverable of the WebApps WG and Web Annotation > WG (listed as

Re: Call for Consensus: Publish First Public Working Draft of FindText API, respond by 14 October

2015-10-08 Thread Frederick Hirsch
+1 to FPWD of FindText API > On Oct 7, 2015, at 11:38 AM, Robert Sanderson wrote: > > +1 to FPWD > > On Wed, Oct 7, 2015 at 8:34 AM, Ivan Herman wrote: > I am happy to have this documents published as FPWD. > > Ivan > > > > On 06 Oct 2015, at 22:32 , F

Call for Consensus: Publish First Public Working Draft of FindText API, respond by 14 October

2015-10-06 Thread Frederick Hirsch
he spec's contents and the specification may be updated. If you have any comments or concerns about this CfC, please reply to this e-mail by 14 October at the latest. Positive response is preferred and encouraged, even a +1 will do Silence will be considered as agreement with the proposa

Re: Stability of Widget DigSig

2015-05-08 Thread Frederick Hirsch
no objection, the referenced document is a Recommendation, isn't it? http://www.w3.org/TR/widgets-digsig/ regards, Frederick Frederick Hirsch Chair XML Security WG fjhirsch.com @fjhirsch > On May 8, 2015, at 7:14 AM, Arthur Barstow wrote: > > [ + Marcos and Frederick ]

Re: [W3C TCP and UDP Socket API]: Status and home for this specification

2015-04-07 Thread Frederick Hirsch
cases going forward? This might be useful before considering venue for the work and detailed issues. (Is there a public web page with information on current implementations?) thanks regards, Frederick Frederick Hirsch www.fjhirsch.com @fjhirsch > On Apr 1, 2015, at 5:22 AM, Nilsson,

Re: Proposal for a Permissions API

2014-09-15 Thread Frederick Hirsch
versions. This Working Group’s deliverables must address issues of accessibility, internationalization, mobility,security and privacy. ]] Discussed at 4 Sep teleconference [2] regards, Frederick Frederick Hirsch, Nokia Chair DAP @fjhirsch [1] http://www.w3.org/2011/07/DeviceAPICharter [2

Re: [ambient light events LC] Feedback ( LC-2736)

2013-01-17 Thread frederick . hirsch
Dear Tab Atkins Jr. , The Device APIs Working Group has reviewed the comments you sent [1] on the Last Call Working Draft [2] of the Ambient Light Events published on 13 Dec 2012. Thank you for having taken the time to review the document and to send us comments! The Working Group's response to

Re: Re: Indicating certificate order in XML Dig Sig ( LC-2504)

2011-08-15 Thread frederick . hirsch
Dear Marcos Caceres , The XML Security Working Group has reviewed the comments you sent [1] on the Last Call Working Draft [2] of the XML Signature Syntax and Processing Version 1.1 published on 3 Mar 2011. Thank you for having taken the time to review the document and to send us comments! The

Re: Pre-LC Review Requested: System Information API

2010-05-11 Thread Frederick Hirsch
battery - isBeingCharged: true if the current power source is a battery and is being charged What do you think? This seems clearer and more straightforward. regards, Frederick Frederick Hirsch Nokia On May 11, 2010, at 10:47 AM, ext Max Froumentin wrote: On 10/05/2010 17:36, timeless

Re: Minor DigSig feedback

2010-05-06 Thread Frederick Hirsch
in the proposed editors draft [1] this is section 10.2 item #3 I suggest we change 3a from "The URI attribute ..." to be "For references that are not same-document references, the URI attribute..." regards, Frederick Frederick Hirsch Nokia On May 5, 2010, at 11:41 AM

Re: Minor DigSig feedback

2010-05-06 Thread Frederick Hirsch
Andreas Thanks, good catch. regards, Frederick Frederick Hirsch Nokia On May 5, 2010, at 11:41 AM, ext Andreas Kuehne wrote: Hi all, just a minor comment found by build a test case : Section 7.1. Common Constraints for Signature Generation and Validation 1. [...] 2

Review of update to Widget Signature

2010-04-30 Thread Frederick Hirsch
looks like the same net effect on implementations. Thanks regards, Frederick Frederick Hirsch Nokia

Re: Reminder: RfC: LCWD of Digital Signatures for Widgets; deadline 6 May 2010

2010-04-29 Thread Frederick Hirsch
Frederick Hirsch Nokia On Apr 29, 2010, at 12:17 PM, ext Marcos Caceres wrote: I have fund a number of issues with the dig sig spec: 1. The conformance model is all screwy: it mixes conformance criteria for too many products (including ones on which were it makes no sense, like signature documents

Updated Digital Signatures for Widgets Editors Draft

2010-04-08 Thread Frederick Hirsch
3 fourth paragraph; and References for [XMLDSIG11], [XMLSecAlgs], [XMLDSIG-Properties]. regards, Frederick Frederick Hirsch Nokia [1] http://lists.w3.org/Archives/Public/public-webapps/2010AprJun/0051.html

Re: Widget Signature modification proposal (revised)

2010-04-07 Thread Frederick Hirsch
Frederick Hirsch Nokia On Apr 7, 2010, at 9:19 AM, Hirsch Frederick (Nokia-CIC/Boston) wrote: Thanks Andreas Yes it seems counter-intuitive not to canonicalize XML, but it is really only needed once the XML has been parsed, and avoiding canonicalization saves resources. Are you aware of the XML

Re: Widget Signature modification proposal (revised)

2010-04-07 Thread Frederick Hirsch
]? These are intended to improve simplicity, usability, streamability, reduced attack surface etc. Your comments would be very welcome! regards, Frederick Frederick Hirsch Nokia [1] http://www.w3.org/TR/2010/WD-xml-c14n2-20100304/ [2] http://www.w3.org/TR/2010/WD-xmldsig-core2-20100304/ On

Re: Widget Signature modification proposal (revised)

2010-04-07 Thread Frederick Hirsch
, Frederick Frederick Hirsch Nokia On Apr 7, 2010, at 6:04 AM, ext Thomas Roessler wrote: kue...@trustable.de wrote: from the implementors perspective these modifications don't introduce too much trouble. But I'm a little bit concerned about the explicit ban of canonicalizations for

Widget Signature modification proposal (revised)

2010-04-06 Thread Frederick Hirsch
review comments. regards, Frederick Frederick Hirsch Nokia - start - (A) Revised Proposal (correction for limiting canonicalization of XML to same document references and backward compatibility) Disallow all Transforms except for a single canonicalization transform that is required for every

Re: Widget Signature Issue and Proposed Resolution

2010-03-31 Thread Frederick Hirsch
s05] http://www.w3.org/TR/2000/REC-xhtml1-2126/";> [s06] [s07] http://www.w3.org/2006/12/xml-c14n11"/> [s08] [s09] http://www.w3.org/2001/04/ xmlenc#sha256"/> [s10] dGhpcyBpcyBub3QgYSBzaWduYXR1cmUK... [s11] http://www.w3.org/2008/xmlsec/Drafts/xmldsig-core-11/Overv

Widget Signature Issue and Proposed Resolution

2010-03-29 Thread Frederick Hirsch
-- regards, Frederick Frederick Hirsch Nokia [1] http://www.w3.org/TR/widgets-digsig/

Please review LCWD of XML Signature 1.1 and Signature Properties; 2.0 draft information

2010-02-12 Thread Frederick Hirsch
-20/ * XML Signature 2.0: http://www.w3.org/2008/xmlsec/Drafts/xmldsig-core-20/ regards, Frederick Frederick Hirsch, Nokia Chair XML Security WG On Feb 10, 2010, at 6:48 AM, Barstow Art (Nokia-CIC/Boston) wrote: Last week the XML Security WG published LCWDs of two specs the Widget Digital

Editorial Update: Signature Properties

2010-01-08 Thread Frederick Hirsch
e had to date. This should not break any implementations but make it easier to find and work with the schema. Comments/corrections welcome. Thanks regards, Frederick Frederick Hirsch Nokia Begin forwarded message: From: "Hirsch Frederick (Nokia-CIC/Boston)" > Date: January

Re: [widgets] DigSig - proposed change to XML Signature Properties

2010-01-07 Thread Frederick Hirsch
Signature Properties is about to enter Last Call. regards, Frederick Frederick Hirsch Nokia [1] http://www.w3.org/2005/10/Process-20051014/tr.html#cfi On Jan 7, 2010, at 2:17 PM, Barstow Art (Nokia-CIC/Boston) wrote: The XML Security WG is considering changing the syntax of the Profile and

Re: [WARP4U] WARP with UPnP, was: RE: [widgets] Draft Minutes for 19 November 2009 Voice Conference

2009-12-03 Thread Frederick Hirsch
+1, duplicating material is a recipe for disaster. regards, Frederick Frederick Hirsch Nokia On Dec 2, 2009, at 8:22 AM, ext Robin Berjon wrote: On Dec 1, 2009, at 22:22 , Marcin Hanclik wrote: Can you please update this to just be a delta? As far as I know W3C specs, delta documents are

Re: Renaming WebDatabase and WebSimpleDB

2009-11-30 Thread Frederick Hirsch
how about "Indexed Sequential Web Database", losing the acronym, even if familiar to those who work with databases? (not web-indexed, however...) regards, Frederick Frederick Hirsch Nokia On Nov 30, 2009, at 8:11 PM, ext Michael Nordman wrote: Web-Indexed-Storage On Mon, No

Re: Security evaluation of an example DAP policy

2009-11-20 Thread Frederick Hirsch
detail on the use cases or additional use cases? regards, Frederick Frederick Hirsch Nokia On Nov 20, 2009, at 10:12 AM, ext Marcin Hanclik wrote: Hi, Reliably identified Websites can send and receive SMS except to premium rate numbers. There seems to be no worldwide pattern to recognize

Re: Security evaluation of an example DAP policy

2009-11-20 Thread Frederick Hirsch
te numbers. Do we need to go into more detail on these two (as examples)? regards, Frederick Frederick Hirsch Nokia On Nov 20, 2009, at 9:15 AM, ext Jeremy Orlow wrote: These are reasons, but I think the greatest cause of our concern is that we have not seen any examples of how policies c

Re: Security evaluation of an example DAP policy

2009-11-20 Thread Frederick Hirsch
chair) Frederick Hirsch Nokia On Nov 19, 2009, at 7:49 PM, ext Marcin Hanclik wrote: Hi Jonas, Maciej, It seems that the policy that you would accept would be: /.+/match> Let's see how DAP will evolve then. T

Re: DAP and security (was: Rename "File API" to "FileReader API"?)

2009-11-18 Thread Frederick Hirsch
idea what most directories are for or where to navigate). Arbitrary directory navigation for writing files is not a good idea. More importantly we have to be careful with analogies. regards, Frederick Frederick Hirsch Nokia On Nov 18, 2009, at 3:14 PM, ext Jonas Sicking wrote: On Wed, Nov 1

Re: Rename “File API” to “FileReader API”?

2009-11-11 Thread Frederick Hirsch
ty as an integral part of API development, while also developing policy mechanisms, thus I do not think the view you mention is "widely held". regards, Frederick Frederick Hirsch Nokia On Nov 10, 2009, at 8:47 PM, ext Maciej Stachowiak wrote: On Nov 10, 2009, at 3:09 AM, Robin Berjo

Re: Proposed additional topic for joint DAP/WebApps Widgets F2F session

2009-10-29 Thread Frederick Hirsch
David Would it be possible for you to summarize what you think the issue is, as far as architecture and technical disparities, as a first step? regards, Frederick Frederick Hirsch Nokia On Oct 29, 2009, at 11:54 AM, ext David Rogers wrote: Hi, As discussed on the webapps call, in

Proposed additional topic for joint DAP/WebApps Widgets F2F session

2009-10-29 Thread Frederick Hirsch
WG from everyone who can help the DAP WG and I'd like to make sure that somehow we have this discussion during TPAC. Thus Agenda topic for joint DAP/Webapps-Widget is "Security Considerations, including HTML5". regards, Frederick Frederick Hirsch, Nokia Co-Chair, W3C DAP Working Group

Re: Widget DigSign: Example of a distributor signature document is buggy

2009-10-08 Thread Frederick Hirsch
ature in the widget package, syntax correctness, presence of required property elements, and use of Role attribute for author and distributor signatures. 2. Signature value verification when specific algorithms are used for a given input. regards, Frederick Frederick Hirsch Nokia On

Re: Widget DigSign: Example of a distributor signature document is buggy

2009-10-07 Thread Frederick Hirsch
Christian You are correct, thank you for catching this error. I have updated the editors draft accordingly. http://dev.w3.org/2006/waf/widgets-digsig/#example regards, Frederick Frederick Hirsch Nokia On Oct 6, 2009, at 9:44 AM, ext Breitschwerdt, Christian, VF-Group wrote: Hi Marcos

Re: HTML extension for system idle detection.

2009-09-17 Thread Frederick Hirsch
isn't the mere knowledge of the level of activity on a device a possible privacy concern, and couldn't the pattern of activity offer a traffic analysis type opportunity? regards, Frederick Frederick Hirsch Nokia On Sep 17, 2009, at 1:35 PM, ext Jeremy Orlow wrote: On Thu, Se

Re: [WARP] Last Call comments (1)

2009-09-10 Thread Frederick Hirsch
this is correct, aren't these fundamentally different? regards, Frederick Frederick Hirsch Nokia On Aug 27, 2009, at 2:06 PM, ext Marcin Hanclik wrote: Hi All, Here are a couple of the Last Call comments to WARP LCWD [1]. They were already partially presented in my emails [2] and

Re: [cors] Additional Comments on 17 March 2009 cors draft

2009-07-01 Thread Frederick Hirsch
So the issue is not confidentiality, it is inappropriate script execution. Got it. Thanks Anne regards, Frederick Frederick Hirsch Nokia On Jul 1, 2009, at 5:34 AM, ext Anne van Kesteren wrote: I might not have time to address your larger set of questions before I leave on vacation

Re: [cors] Additional Comments on 17 March 2009 cors draft

2009-06-30 Thread Frederick Hirsch
policy 3. if policy disallows then the browser does not allow the content to be used. In any case, doesn't this open an attack to get the content by sniffing the wire for the response content, regardless of the header? regards, Frederick Frederick Hirsch Nokia [1] http://arunrang

[cors] Comments on 17 March 2009

2009-06-30 Thread Frederick Hirsch
22 Editorial: Section 4.5 Where is the full list of headers defined? is a reference needed? 23 Editorial: Section 5.1 #1 Can the list of origins be unbounded in practice? 24 Editorial: Section 6 Mark "Everything with regards to redirects might change a little to more closely adhere to HTTP redirect semantics." as an editors note. 25 Editorial: Section 6.1 some of the spacing between items seems to need additional space 26 Editorial: Section 7.3 Replace "progresing" with "progressing" regards, Frederick Frederick Hirsch Nokia

Re: [widgets] dig sig RelaxNG schema

2009-06-25 Thread Frederick Hirsch
x27;m copying this message with the XML Security WG. Thanks regards, Frederick Frederick Hirsch, Nokia Chair XML Security WG [1] http://www.w3.org/2008/xmlsec/Drafts/xmldsig-core-11/Overview.htm#sec-Schema [2] http://www.w3.org/2007/xmlsec/Drafts/xmldsig-rngschema/ On Jun 25, 2009, at 7:13 AM, ex

Re: Reminder: Comments for LCWD of Widgets 1.0: Digital Signatures due June 1

2009-06-08 Thread Frederick Hirsch
st wg call to freeze the spec but I guess not... ) regards, Frederick Frederick Hirsch Nokia On Jun 8, 2009, at 7:07 AM, ext Marcos Caceres wrote: On Thu, Jun 4, 2009 at 2:27 PM, Priestley, Mark, VF-Group wrote: Hi Art, All, Vodafone has some late comments which it would like to provide t

Re: Reminder: Comments for LCWD of Widgets 1.0: Digital Signatures due June 1

2009-06-08 Thread Frederick Hirsch
XML Signature 1.1 should be referenced. It defines the URI for the algorithms, context for use in XML Signature, and references etc. regards, Frederick Frederick Hirsch Nokia On Jun 8, 2009, at 8:30 AM, ext Marcin Hanclik wrote: Hi Marcos, Also, DSA-SHA-1, RSA-SHA-256, and ECDSA-SHA

Re: Widgets 1.0: Digital Signatures

2009-06-04 Thread Frederick Hirsch
Thanks for the review Josh. These all look editorial to me and I assume we can handle them during CR. regards, Frederick Frederick Hirsch Nokia On Jun 4, 2009, at 9:30 AM, ext timeless wrote: Hi, apologies for the late comments. I hope all of my comments are of an editorial nature. The

Re: Reminder: Comments for LCWD of Widgets 1.0: Digital Signatures due June 1

2009-06-04 Thread Frederick Hirsch
XML Signature 1.1 notes that the order of certificates in X.509Data is not specified. http://www.w3.org/2008/xmlsec/Drafts/xmldsig-core-11/Overview.htm#sec-X509Data Is this really expected to be an issue, with long cert chains? regards, Frederick Frederick Hirsch Nokia On Jun 4, 2009

Re: [widgets] dig sig and requirements ready for pub!

2009-05-07 Thread Frederick Hirsch
I assume this issue is closed with no need to add this text, given the subsequent thread. If this is incorrect please note that on the list. Thanks regards, Frederick Frederick Hirsch Nokia On May 5, 2009, at 6:33 AM, Barstow Art (Nokia-CIC/Boston) wrote: On May 4, 2009, at 10:13 AM

[widgets-digsig] minor editorial update

2009-05-07 Thread Frederick Hirsch
t;Although" etc as a note. http://dev.w3.org/2006/waf/widgets-digsig/#algorithms regards, Frederick Frederick Hirsch Nokia

Re: [widgets] dig sig and requirements ready for pub!

2009-05-05 Thread Frederick Hirsch
I was aware of what you quoted Marcos, but it was implicit. If it is ok, then I'm not sure why we've been having this email thread... regards, Frederick Frederick Hirsch Nokia On May 5, 2009, at 6:38 AM, ext Marcos Caceres wrote: On Tue, May 5, 2009 at 12:33 PM, Arthur Barsto

Re: [widgets] dig sig and requirements ready for pub!

2009-05-04 Thread Frederick Hirsch
The spec is more than a UA spec, it also describes signature format which affects parties other than the UA (e.g. audit etc) regards, Frederick Frederick Hirsch Nokia On May 4, 2009, at 12:42 PM, ext Marcos Caceres wrote: On Mon, May 4, 2009 at 4:13 PM, Frederick Hirsch wrote: The

Re: [widgets] dig sig and requirements ready for pub!

2009-05-04 Thread Frederick Hirsch
[XMLDSIG- Properties] and this specification. We can add, "A signer MUST place the dsp:Identifier signature property into the signature when generating the signature." if necessary. regards, Frederick Frederick Hirsch Nokia On May 4, 2009, at 9:38 AM, Barstow Art (Nokia-CIC/Bos

[widget-digsig] XML Signature Properties published

2009-04-30 Thread Frederick Hirsch
] http://www.w3.org/Security/ [4] http://www.w3.org/News/2009#item63 regards, Frederick Frederick Hirsch Nokia

[widget-digsig] Update to widget signature

2009-04-29 Thread Frederick Hirsch
. Updated status of the document section. regards, Frederick Frederick Hirsch Nokia [1] http://dev.w3.org/2006/waf/widgets-digsig/

Re: [widgets] Dig Sig review in prep for LC

2009-04-29 Thread Frederick Hirsch
comments inline, including proposals. thanks for the review regards, Frederick Frederick Hirsch Nokia On Apr 29, 2009, at 4:01 AM, ext Marcos Caceres wrote: Hi Frederick, Some tiny editorial changes I think we should add the following sub-section to the Status of This Document

Re: [widgets] Dig Sig review in prep for LC

2009-04-29 Thread Frederick Hirsch
+1 I don't see the need for that paragraph. regards, Frederick Frederick Hirsch Nokia On Apr 29, 2009, at 6:36 AM, ext Thomas Roessler wrote: Hi Frederick, Some tiny editorial changes I think we should add the following sub-section to the Status of This Document: [[ Note to

Updates to Widget Signature

2009-04-28 Thread Frederick Hirsch
ase let me know of any issues with these changes or any other corrections by tomorrow morning Eastern time. Thank you regards, Frederick Frederick Hirsch Nokia [1] http://dev.w3.org/2006/waf/widgets-digsig/#naming-convention-for-an-author-signature and http://dev.w3.org/2006/waf/widg

Proposal to update signature text in Packaging and Config, remove from Widget Signature

2009-04-27 Thread Frederick Hirsch
lly think P&C should use uppercase MUSTs etc. regards, Frederick Frederick Hirsch Nokia

Re: [widget-digsig] Updated Widget Signature editors draft

2009-04-24 Thread Frederick Hirsch
necessary if a security issue is discovered with the currently required algorithm. regards, Frederick Frederick Hirsch Nokia On Apr 24, 2009, at 5:20 AM, ext Priestley, Mark, VF-Group wrote: "I would like to see some text cautioning authors not to rely on this algorithm, since it is opt

[widget-digsig] Updated Widget Signature editors draft

2009-04-23 Thread Frederick Hirsch
section 9 Added FIPS-186-3 reference http://dev.w3.org/2006/waf/widgets-digsig/ Note that we will need to update the Signature Properties reference, when that specification is published with this specification. regards, Frederick Frederick Hirsch Nokia

Re: [widget-digsig] Pls review: Additional considerations on elliptic curve algorithms to consider

2009-04-23 Thread Frederick Hirsch
I agree . Also to be clear Mark, I believe you are saying VF supports a MUST in the XML Signature 1.1 specification. regards, Frederick Frederick Hirsch Nokia On Apr 23, 2009, at 8:15 AM, ext David Rogers wrote: Marcos, Surely the logic should support algorithm evolution in that way

Re: [widgets] New WD of Widgets 1.0: Digital Signatures spec published on March 31

2009-04-23 Thread Frederick Hirsch
I've added this to the Widgets Signature specification. regards, Frederick Frederick Hirsch Nokia On Apr 23, 2009, at 3:18 AM, ext Priestley, Mark, VF-Group wrote: Thanks Frederick! -Original Message- From: Frederick Hirsch [mailto:frederick.hir...@nokia.com] Sent: 22 April

Re: [widgets] New WD of Widgets 1.0: Digital Signatures spec published on March 31

2009-04-22 Thread Frederick Hirsch
blogs and also to see if any new mistakes have been introduced. regards, Frederick Frederick Hirsch Nokia On Apr 22, 2009, at 5:53 PM, ext Priestley, Mark, VF-Group wrote: Thanks Frederick and Marcos - responses inline. Only a couple of questions left :) Regards, Mark -Original Message

[widget-digsig] updated Widget Signature editors draft

2009-04-22 Thread Frederick Hirsch
s into the requirements document, and thus possibly the requirements section in general. regards, Frederick Frederick Hirsch Nokia

Re: [widgets] New WD of Widgets 1.0: Digital Signatures spec published on March 31

2009-04-22 Thread Frederick Hirsch
it will be correct to talk about "files". I don't think we can always expect creation of a physical file for processing. Suggest not making any change here. regards, Frederick Frederick Hirsch Nokia On Apr 22, 2009, at 6:45 AM, ext Marcos Caceres wrote: On Tue, Apr 21, 20

Re: [widgets] Agenda for 23 April 2009 Voice Conference

2009-04-22 Thread Frederick Hirsch
I agree that the sentence should be dropped. I'll take an editorial pass today to remove that sentence, address the agreed changes on Mark's editorial comments and to remove the Created material. Thanks for noting this one. regards, Frederick Frederick Hirsch Nokia On Apr 22

Re: [widgets] Agenda for 23 April 2009 Voice Conference

2009-04-22 Thread Frederick Hirsch
update of Signature Properties, thus remove section 9 from widget signature http://dev.w3.org/2006/waf/widgets-digsig/#sigproperties any other comments received that we might have missed? regards, Frederick Frederick Hirsch Nokia On Apr 22, 2009, at 7:36 AM, Barstow Art (Nokia-CIC/Bos

Re: [widget] [widget-digsig] Comment on WD of Widgets 1.0: Digital Signatures - use of Created property

2009-04-21 Thread Frederick Hirsch
if there is no need for the Created property in the Widgets Signature spec I suggest we remove it, though keep what we have in the Signature Properties specification. regards, Frederick Frederick Hirsch Nokia On Apr 15, 2009, at 5:45 AM, ext Priestley, Mark, VF-Group wrote: Dear All

Re: [widgets] New WD of Widgets 1.0: Digital Signatures spec published on March 31

2009-04-21 Thread Frederick Hirsch
Mark Please find responses inline. Thanks for the review. regards, Frederick Frederick Hirsch Nokia On Apr 7, 2009, at 2:27 AM, ext Priestley, Mark, VF-Group wrote: Hi Art, All, Please find below my editorial comments and requests for clarifications based on the new WD [1]. While it

Proposal for ISSUE-83

2009-04-21 Thread Frederick Hirsch
ments the OPTIONAL [Widgts-DigSig] specification, in which case the user agent MUST make signature documents available to the implementation of the [Widgets-DigSig] specification." This message should complete ACTION-329 which should be closed. regards, Frederick Frederick Hirsch Nokia

Re: [widgets] Jar signing vs. XML signatures

2009-04-15 Thread Frederick Hirsch
mentations. So apart from personal preference I do not see why a change is needed. regards, Frederick Frederick Hirsch Nokia On Apr 15, 2009, at 3:00 PM, ext Jonas Sicking wrote: On Tue, Apr 14, 2009 at 4:38 AM, Marcos Caceres wrote: Although I agree that it was probably a short-sightedne

Re: ISSUE-83 (digsig should not be read at runtime): Instantiated widget should not be able to read digital signature [Widgets]

2009-04-14 Thread Frederick Hirsch
+1 I do not understand the attack, but can envision cases where precluding access could cause problems. Examples might be user "see what is signed" or access to signature properties. Is this an access control issue rather than a general specification rule? regards, Frederick

[widget-digsig] Pls review: Additional considerations on elliptic curve algorithms to consider

2009-04-08 Thread Frederick Hirsch
algorithms should be required in Widget Signature. Please share this additional information in your organization and indicate if it would cause any change in position regarding the mandatory to implement algorithms. Thank you regards, Frederick Frederick Hirsch, Nokia Chair XML Se

Re: ISSUE-83 (digsig should not be read at runtime): Instantiated widget should not be able to read digital signature [Widgets]

2009-04-02 Thread Frederick Hirsch
ecure (and of course there are no attacks available against the algorithms and so on). regards, Frederick Frederick Hirsch Nokia On Apr 2, 2009, at 5:20 PM, ext Priestley, Mark, VF-Group wrote: Hi Art, All, I tracked down my original explanation with subsequent qualification [1]. The pr

Re: [widget-digsig] Updated Editors Draft of Widget Signature

2009-03-27 Thread Frederick Hirsch
I ran this through the W3C validator and fixed validation errors and warnings, it now validates cleanly. regards, Frederick Frederick Hirsch Nokia On Mar 27, 2009, at 3:02 PM, Hirsch Frederick (Nokia-CIC/Boston) wrote: I have completed a major round of editorial updates to the Widget

[widget-digsig] Updated Editors Draft of Widget Signature

2009-03-27 Thread Frederick Hirsch
s/Public/public-webapps/2009JanMar/0982.html regards, Frederick Frederick Hirsch Nokia [1] added Numerical order is the order based on the numeric portion of the signature file name. Thus the highest numbered distributor signature would be validated first. to section 4, #6 --- replace The ord

Re: [BONDI Architecture & Security] [widgets] new digsig draft

2009-03-27 Thread Frederick Hirsch
I think we should remove it. Also, I revised the e.g. as follows ... undesireable and security relevant effects, such as overwriting of startup or system files. regards, Frederick Frederick Hirsch Nokia On Mar 27, 2009, at 2:00 PM, ext Hillebrand, Rainer wrote: Dear Frederick, I

Re: [BONDI Architecture & Security] [widgets] new digsig draft

2009-03-27 Thread Frederick Hirsch
comments inline, thanks for reviewing this regards, Frederick Frederick Hirsch Nokia On Mar 27, 2009, at 1:26 PM, ext Hillebrand, Rainer wrote: Dear Marcos, I hope to have less critical comments than in my last feedback email. 1. Section 7.1: change "The ds:SignatureMethod algo

Re: [widgets] Author

2009-03-27 Thread Frederick Hirsch
No I agree, we are trying to stay away from legal statements , that requires much more. regards, Frederick Frederick Hirsch Nokia On Mar 27, 2009, at 10:40 AM, ext Marcin Hanclik wrote: Hi Frederick, re author, would the term "creator" in the sentence from Thomas help, thi

Re: [BONDI Architecture & Security] [widgets] new digsig draft, further comments

2009-03-27 Thread Frederick Hirsch
author means creator... also, ok with your proposed change Within a widget package these signature files MUST be ordered based on the numeric portion of the signature file name. regards, Frederick Frederick Hirsch Nokia On Mar 27, 2009, at 9:41 AM, ext Marcin Hanclik wrote: Hi Frederick, Th

Re: [BONDI Architecture & Security] [widgets] new digsig draft

2009-03-27 Thread Frederick Hirsch
Marcin Thanks, for the careful review. some comment inline [removed cross post, fails anyway] regards, Frederick Frederick Hirsch Nokia On Mar 26, 2009, at 2:04 PM, ext Marcin Hanclik wrote: Hi Marcos, All, Please find below my - mostly editorial - comments to the latest digsig

Re: [BONDI Architecture & Security] [widgets] new digsig draft, further comments

2009-03-27 Thread Frederick Hirsch
Marcin [removed cross-posting, since my posting would fail anyway] comments inline regards, Frederick Frederick Hirsch Nokia On Mar 27, 2009, at 5:27 AM, ext Marcin Hanclik wrote: Hi Marcos, These are my further comments to the DigSig spec: 1. There is no section about typographic

Re: AW: Re: [BONDI Architecture & Security] [widgets] new digsig draft

2009-03-26 Thread Frederick Hirsch
n the same category as policy and other such important considerations, which we have not detailed in the specification. regards, Frederick Frederick Hirsch Nokia On Mar 26, 2009, at 5:06 PM, ext Marcin Hanclik wrote: Hi, I support this view. In the whole design of various widget signature

Re: AW: Re: [BONDI Architecture & Security] [widgets] new digsig draft

2009-03-26 Thread Frederick Hirsch
I think the draft provides enough assurance for the intended level of use. If you want higher levels of assurance more will be required, but I don't believe we have a requirement here for that. regards, Frederick Frederick Hirsch Nokia On Mar 26, 2009, at 12:20 PM, ext Hillebrand, R

Re: AW: Re: [BONDI Architecture & Security] [widgets] new digsig draft

2009-03-26 Thread Frederick Hirsch
having used the same signing key are from the same party . regards, Frederick Frederick Hirsch Nokia On Mar 26, 2009, at 12:14 PM, ext Hillebrand, Rainer wrote: Hi Marcos! I agree with your suggestions. Best Regards, Rainer --- Sent from m

Re: [BONDI Architecture & Security] [widgets] new digsig draft

2009-03-26 Thread Frederick Hirsch
Frederick Hirsch Nokia On Mar 26, 2009, at 12:58 PM, ext Priestley, Mark, VF-Group wrote: Hi All, As the author signature was something I had a hand in creating let me add my 2 pence worth. Rainer is correct in that the author signature need not actually come from the author of the

additional widgets signature fix

2009-03-26 Thread Frederick Hirsch
I fixed one additional ordered list nit in widgets signature, so it validates correctly. When published the document date will need to be updated to the publication date. regards, Frederick Frederick Hirsch Nokia

Re: [widgets] new digsig draft

2009-03-26 Thread Frederick Hirsch
Marcos I checked in another revision to fix the broken link in 7. 2 (last sentence included s in span) and to fix various validation errors. The latest revision looks ok to me now, version 1.85 of Overview.src.html, version 1.93 of Overview.html regards, Frederick Frederick Hirsch

Re: [widgets] new digsig draft

2009-03-25 Thread Frederick Hirsch
rs vs working draft I think). I also notice on a substantive level that you changed the namespace. Was the reason to match a pre-existing choice for the Packaging and Configuration? Is this an item for discussion? The other changes looked good, thanks for improving the draft. regards,

Re: [widget-digsig] Editorial update of Widget Signature

2009-03-19 Thread Frederick Hirsch
Completed additional changes to Editorial note in section 6, added links to XML Security WG home page, list of comments on FPWD and mailto link for comments on XML Signature 1.1. Also fixed editorial nit, "final set" to "a final set" regards, Frederick Frederick Hirsc

[widget-digsig] Editorial update of Widget Signature

2009-03-19 Thread Frederick Hirsch
WG agreed earlier that we would add this material. 4. Changed "Security Policy" to lowercase as appropriate. This should complete all my editorial actions before publication. Please review and let me know of any corrections or noted omissions. regards, Frederick Frederick Hirsch Noki

Re: [widget-digsig] changed widget signature files processing rule in section 4

2009-03-19 Thread Frederick Hirsch
I think the current text is clearer since it make clear which direction to process the list, which would be ambiguous otherwise. regards, Frederick Frederick Hirsch Nokia On Mar 19, 2009, at 9:40 AM, ext Priestley, Mark, VF-Group wrote: Hi Frederick, Small comment. I would change the

RE: [widget-digsig] proposed change to 7.1, common constraints, for algorithms

2009-03-19 Thread Frederick Hirsch
bly should review whether we need key length defined for each algorithm but can defer for now. Will this change of sentence work ? Thanks regards, Frederick Frederick Hirsch Nokia (for some reason this message of yours did not reach my personal inbox, but it was on the list) Hi Frederic

Re: [widget-digsig] Editors note to be added to widget signature

2009-03-19 Thread Frederick Hirsch
XML Security WG is also requesting feedback on the FPWD of XML SIgnature 1.1. regards, Frederick Frederick Hirsch Nokia On Mar 19, 2009, at 9:48 AM, Hirsch Frederick (Nokia-CIC/Boston) wrote: Based on the discussion on today's call, I will add the following editors note to Widget Signatu

[widget-digsig] Editors note to be added to widget signature

2009-03-19 Thread Frederick Hirsch
FPWD of XML SIgnature 1.1. regards, Frederick Frederick Hirsch Nokia [1] http://dev.w3.org/2006/waf/widgets-digsig/#algorithms

Re: [widgets] Minutes from 25 February 2009 Widgets F2F Meeting

2009-03-19 Thread Frederick Hirsch
XML Security WG continues to refine XML Signature 1.1 and is looking for feedback. Thanks regards, Frederick Frederick Hirsch Nokia On Mar 19, 2009, at 6:17 AM, ext Hillebrand, Rainer wrote: Dear Art, May I give feedback on an old action item regarding the preference for ECDSA vs. DSA

Re: [widgets] Agenda for 19 March 2009 Voice Conference

2009-03-18 Thread Frederick Hirsch
I include some updates and questions inline on Widget Signature with pointers to mail archive. regards, Frederick Frederick Hirsch Nokia On Mar 18, 2009, at 9:41 AM, Barstow Art (Nokia-CIC/Boston) wrote: Below is the draft agenda for the March 19 Widgets Voice Conference (VC). Inputs

[widget-digsig] changed widget signature files processing rule in section 4

2009-03-18 Thread Frederick Hirsch
correction. The latest draft also changes all usage of "widget user agent" to "user agent". regards, Frederick Frederick Hirsch Nokia On Mar 16, 2009, at 4:46 PM, ext Priestley, Mark, VF-Group wrote: [mp] My view is that whether zero, one or more signatures is processed

[widgets-digsig] Updated 5.1 with revised Reference constraint text

2009-03-18 Thread Frederick Hirsch
additional comment or corrections. Thanks Marcos for suggestions to this wording. (Also removed Inc from Nokia in title page) regards, Frederick Frederick Hirsch Nokia [1] http://dev.w3.org/2006/waf/widgets-digsig/

[widget-digsig] proposed change to 7.1, common constraints, for algorithms

2009-03-18 Thread Frederick Hirsch
recommended key length Does this change make sense? Do you have any suggestion or comment? Thanks for the careful review of the draft. regards, Frederick Frederick Hirsch Nokia [1] http://dev.w3.org/2006/waf/widgets-digsig/ [mp] While this is better I think it misses the fact that we are strongly

[widget-digsig] zip relative path update

2009-03-18 Thread Frederick Hirsch
, Frederick Frederick Hirsch Nokia [1] http://dev.w3.org/2006/waf/widgets-digsig/ On Mar 17, 2009, at 8:15 AM, ext Marcos Caceres wrote: Hi Frederick, On 3/17/09 1:01 PM, Frederick Hirsch wrote: The latest draft includes the revised text from Thomas. Marcos, are you suggesting we add

Re: [widgets] Comments on Widget Signature update (was RE: Widget Signature update)

2009-03-17 Thread Frederick Hirsch
ig Sig spec. [1] http://dev.w3.org/2006/waf/widgets/#zip-relative-paths regards, Frederick Frederick Hirsch Nokia

  1   2   >