On Tue, 14 Jan 2020 at 21:41, Jonas Schäfer <jo...@wielicki.name> wrote:
> This message constitutes notice of a Last Call for comments on XEP-0363. > The > Last Call was restarted after the Council election, because the previous > Council did not vote on the ongoing LC. > > Title: HTTP File Upload > Abstract: > This specification defines a protocol to request permissions from > another entity to upload a file to a specific path on an HTTP server > and at the same time receive a URL from which that file can later be > downloaded again. > > URL: https://xmpp.org/extensions/xep-0363.html > > This Last Call begins today and shall end at the close of business on > 2020-01-28. > > Please consider the following questions during this Last Call and send > your feedback to the standards@xmpp.org discussion list: > > 1. Is this specification needed to fill gaps in the XMPP protocol > stack or to clarify an existing protocol? > > Yes. While there is some overlap between this specification and Jingle FT, there is no particular reason why these two cannot be used in a useful combination in the future. > 2. Does the specification solve the problem stated in the introduction > and requirements? > > I'm not convinced the last bullet point is a requirement, actually, but if it is it is not met. I think it would be more useful to move this bullet into the Security Considerations. > 3. Do you plan to implement this specification in your code? If not, > why not? > > Not currently; while we move images around we have rather higher requirements on access control as our images contain sensitive patient data, and the simplistic approach taken here is insufficient. However, there are multiple ways to address this and we might revisit. > 4. Do you have any security concerns related to this specification? > > As mentioned above, I don't think "weak security" is a requirement as such, and the Security Considerations do not actually make it explicit that this is the model. It would seem more useful to move that bullet into Security Considerations and rephrase it slightly. > 5. Is the specification accurate and clearly written? > Yes - and incidentally vastly improved since it's original Last Call. Dave.
_______________________________________________ Standards mailing list Info: https://mail.jabber.org/mailman/listinfo/standards Unsubscribe: standards-unsubscr...@xmpp.org _______________________________________________
