RE: AS#2: some minor bits of English

I adjusted the AS2 draft to address all but the last
comment.  This issue of system identification through a name
in the certificate is a hotly debated issue.  I think we
could get in trouble no matter what we say.  Since this is
really outside the scope of AS2, I didn't change anything.
Suggestions?  In the interoperability tests, we
allow/encourage the domain name check but we have found we
cannot require it.

Regards,

David Fischer
Drummond Group.
  -----Original Message-----
  From: [email protected]
[mailto:[email protected]]On Behalf Of Paul V
Ford-Hutchinson
  Sent: Friday, April 19, 2002 10:10 AM
  To: [email protected]
  Subject: AS#2: some minor bits of English



  A few nits

  in as2-10 ...

  - page 5 (seems to be page 5 in -11 pre-draft too)

  "    Many of the specifications referenced by [MIME-TYPES]
were
      designed for SMTP transports. Implementors are advised
to make
      appropriate adjustments for HTTP transport as
indicated in
      section 4 of this document."

  'this document' is ambiguous - I went looking in the draft
and not the reference.

  - section 2.4 last few lines (seems to be section 2.3 in
the -11 pre-draft)

  "making use of the HTTPS scheme to obtain security
privacy."

  'security privacy' is not English

  - bottom of page 14 (middle of page 15 in -11 pre-draft)

  "    Otherwise the automated acknowledgement semantics are
left open
      to further semantic specification by specific
electronic commerce"

  semantic overload ?


  -section 3.2.4 (both docs)

  As https is recommended - should there not be some
discussion of the TLS multi-hosting problem (X.509 DN in
cert vs HOST parm in HTTP)

  Cheers,
  Paul


  --
  Paul Ford-Hutchinson :  eCommerce application security :
[email protected]
  MPT-6, IBM , PO Box 31, Birmingham Rd, Warwick, CV34 5JL
+44 (0)1926 462005
  http://www.ford-hutchinson.com/~fh-1-pfh/ftps-ext.html