W3C home > Mailing lists > Public > public-ws-addressing-comments@w3.org > April 2005

Editorial: Wording clarifications in Core Section 4

From: Jonathan Marsh <jmarsh@microsoft.com>
Date: Fri, 29 Apr 2005 10:58:53 -0700
Message-ID: <7DA77BF2392448449D094BCEF67569A5075B677F@RED-MSG-30.redmond.corp.microsoft.com>
To: <public-ws-addressing-comments@w3.org>

4. Security Considerations

  "Users of WS-Addressing and EPRs (i.e., entities creating, consuming
  or receiving Message Addressing Properties and EPRs) SHOULD only use
  EPRs from sources they trust. For example, such users might only use
  EPRs that are signed by parties the user of the EPR trusts, or have
  some out-of-band means of establishing trust."

It's not quite clear what the "or have" refers to - the users? The
trusted parties?  Suggest rewording the last sentence as:

  "For example, such users might rely on the presence of a verifiable
  signature by a trusted party over the EPR, or an out-of-band means 
  of establishing trust, to determine whether they should use a
  particular EPR."

In the next paragraph:
  "integrity protected" -> "integrity-protected"

  "Such optional integrity protection might be provided by transport,
  message level signature, and use of an XML digital signature within

Seems like this "and" should be "or".  For clarity, how about this

  "Such optional integrity protection might be provided by a transport
  or message-level signature, or the use of an XML digital signature
  within an EPR."
Received on Friday, 29 April 2005 17:59:15 GMT

This archive was generated by hypermail 2.2.0+W3C-0.50 : Tuesday, 8 January 2008 14:19:38 GMT