Same-Origin Policy for the RPKI Repository Delta Protocol (RRDP)
draft-ietf-sidrops-rrdp-same-origin-04

Yes

Gunter Van de Velde
John Scudder
Warren Kumari

No Objection

Deb Cooley
Erik Kline
Francesca Palombini
Jim Guichard
Mahesh Jethanandani
Murray Kucherawy
Orie Steele
Paul Wouters
Roman Danyliw
Zaheduzzaman Sarker
Éric Vyncke

Note: This ballot was opened for revision 02 and is now closed.

Gunter Van de Velde
Yes
Comment (2024-09-27 for -02) Not sent 
Well written document
John Scudder
Yes
Warren Kumari
Yes
Deb Cooley
No Objection
Erik Kline
No Objection
Comment (2024-09-28 for -02) Not sent 
# Internet AD comments for draft-ietf-sidrops-rrdp-same-origin-02
CC @ekline

* comment syntax:
  - https://github.com/mnot/ietf-comments/blob/main/format.md

* "Handling Ballot Positions":
  - https://ietf.org/about/groups/iesg/statements/handling-ballot-positions/

## Nits

### S4

* "Registies" -> "Registries"
Francesca Palombini
No Objection
Jim Guichard
No Objection
Mahesh Jethanandani
No Objection
Murray Kucherawy
No Objection
Orie Steele
No Objection
Paul Wouters
No Objection
Roman Danyliw
No Objection
Comment (2024-09-30 for -02) Sent 
Thank you to Meral Shirazipour for the GENART review.

** Section 5.  Editorial.  Per "This internet-draft patches ...", this text won't be accurate when the I-D is published as an RFC. I recommend: s/internet-draft patches/document patches/.
Zaheduzzaman Sarker
No Objection
Éric Vyncke
No Objection
Comment (2024-10-02 for -03) Sent 
Thanks for the well-written document, easy to read and still useful.

# Section 3.1

s/The uri attribute/The "uri" attribute/ (cosmetic but I like to see the name of a field/attribute enclosed in double quotes, easier to read/parse).

# Section 4

s/At the moment of writing/In July 2024/ (pedantic probably, but let's be accurate, having some references to a research would be plus)

# Section 5

s/This internet-draft patches/This document addresses/

Please move the last sentence (about relative URI) into the introduction, it has little to do in the security considerations.

Should there be a "SHOULD log" when such a cross-origin referral is observed ?