{"action":"closed","issue":{"url":"https://api.github.com/repos/w3c/encrypted-media/issues/273","repository_url":"https://api.github.com/repos/w3c/encrypted-media","labels_url":"https://api.github.com/repos/w3c/encrypted-media/issues/273/labels{/name}","comments_url":"https://api.github.com/repos/w3c/encrypted-media/issues/273/comments","events_url":"https://api.github.com/repos/w3c/encrypted-media/issues/273/events","html_url":"https://github.com/w3c/encrypted-media/issues/273","id":166223066,"number":273,"title":"Comments on security and privacy sections","user":{"login":"ddorwin","id":9738764,"avatar_url":"https://avatars.githubusercontent.com/u/9738764?v=3","gravatar_id":"","url":"https://api.github.com/users/ddorwin","html_url":"https://github.com/ddorwin","followers_url":"https://api.github.com/users/ddorwin/followers","following_url":"https://api.github.com/users/ddorwin/following{/other_user}","gists_url":"https://api.github.com/users/ddorwin/gists{/gist_id}","starred_url":"https://api.github.com/users/ddorwin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ddorwin/subscriptions","organizations_url":"https://api.github.com/users/ddorwin/orgs","repos_url":"https://api.github.com/users/ddorwin/repos","events_url":"https://api.github.com/users/ddorwin/events{/privacy}","received_events_url":"https://api.github.com/users/ddorwin/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/w3c/encrypted-media/labels/needs%20review","name":"needs review","color":"b60205"}],"state":"closed","locked":false,"assignee":{"login":"ddorwin","id":9738764,"avatar_url":"https://avatars.githubusercontent.com/u/9738764?v=3","gravatar_id":"","url":"https://api.github.com/users/ddorwin","html_url":"https://github.com/ddorwin","followers_url":"https://api.github.com/users/ddorwin/followers","following_url":"https://api.github.com/users/ddorwin/following{/other_user}","gists_url":"https://api.github.com/users/ddorwin/gists{/gist_id}","starred_url":"https://api.github.com/users/ddorwin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ddorwin/subscriptions","organizations_url":"https://api.github.com/users/ddorwin/orgs","repos_url":"https://api.github.com/users/ddorwin/repos","events_url":"https://api.github.com/users/ddorwin/events{/privacy}","received_events_url":"https://api.github.com/users/ddorwin/received_events","type":"User","site_admin":false},"assignees":[{"login":"ddorwin","id":9738764,"avatar_url":"https://avatars.githubusercontent.com/u/9738764?v=3","gravatar_id":"","url":"https://api.github.com/users/ddorwin","html_url":"https://github.com/ddorwin","followers_url":"https://api.github.com/users/ddorwin/followers","following_url":"https://api.github.com/users/ddorwin/following{/other_user}","gists_url":"https://api.github.com/users/ddorwin/gists{/gist_id}","starred_url":"https://api.github.com/users/ddorwin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ddorwin/subscriptions","organizations_url":"https://api.github.com/users/ddorwin/orgs","repos_url":"https://api.github.com/users/ddorwin/repos","events_url":"https://api.github.com/users/ddorwin/events{/privacy}","received_events_url":"https://api.github.com/users/ddorwin/received_events","type":"User","site_admin":false}],"milestone":{"url":"https://api.github.com/repos/w3c/encrypted-media/milestones/4","html_url":"https://github.com/w3c/encrypted-media/milestones/V1Editorial","labels_url":"https://api.github.com/repos/w3c/encrypted-media/milestones/4/labels","id":1765807,"number":4,"title":"V1Editorial","description":"Those issues are purely editorial.","creator":{"login":"mwatson2","id":7593867,"avatar_url":"https://avatars.githubusercontent.com/u/7593867?v=3","gravatar_id":"","url":"https://api.github.com/users/mwatson2","html_url":"https://github.com/mwatson2","followers_url":"https://api.github.com/users/mwatson2/followers","following_url":"https://api.github.com/users/mwatson2/following{/other_user}","gists_url":"https://api.github.com/users/mwatson2/gists{/gist_id}","starred_url":"https://api.github.com/users/mwatson2/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mwatson2/subscriptions","organizations_url":"https://api.github.com/users/mwatson2/orgs","repos_url":"https://api.github.com/users/mwatson2/repos","events_url":"https://api.github.com/users/mwatson2/events{/privacy}","received_events_url":"https://api.github.com/users/mwatson2/received_events","type":"User","site_admin":false},"open_issues":7,"closed_issues":42,"state":"open","created_at":"2016-05-14T00:27:23Z","updated_at":"2016-08-16T16:47:46Z","due_on":"2016-08-01T04:00:00Z","closed_at":null},"comments":2,"created_at":"2016-07-19T00:28:06Z","updated_at":"2016-08-16T16:47:46Z","closed_at":"2016-08-16T16:47:46Z","body":"@steelejoe wrote the following in https://github.com/w3c/encrypted-media/issues/221#issuecomment-224341040. I've moved the remaining items (and one reply) here to separate them from the larger \"review\" issue #221.\r\n\r\n>I have some nit-picky comments. Should be relatively easy to address. \r\n>\r\n>Section 10.3.2 Mitigations\r\nTLS -- \"Furthermore, origin-specific permissions in combination with a secure origin, **ensure** that permissions granted to an application **cannot be abused** by a network attacker.\". This language is too strong. We can safely say that TLS makes abuse far less likely, but not impossible. This should be changed to \"Origin-specific permissions in combination with a secure origin make abuse of permissions granted to an application by a network attacker far less likely.\".\r\n>...\r\n>\r\n>Section 11.4.2 Mitigations \"Shared blacklists\"\r\nThis section is unclear. What is a \"Key System origin\"? Does this refer to the dotted identifier for the Key System itself, in which case a blacklist seems like overkill since there are only a small number of Key Systems. Or does this refer specifically to use a particular Key System on an application origin? The latter seems more likely. If that is the correct interpretation this should be changed to \"User agents may allow users to share blacklists of application origins and/or Key Systems\". \r\n>\r\n>Section 11.4.2 Mitigations \"Per-origin user alerts / prompts and permissions\"\r\nThis sentence \"User agents must prompt or otherwise inform the user before allowing use of a Distinctive Identifier that is not unique per-origin and/or not clearable is used. \" is unnecessary based on the note following. Why not just remove it and the note? Apologies if this has been discussed in depth -- I did not see it. "}}
{"actor":{"display_login":"ddorwin"}}