Initial Assignment for the Content Security Policy Directives Registry
draft-west-webappsec-csp-reg-04

[Ballot comment]
Not sure if this is a concern or not.
Disclaimer: I have no background on content security policy directives.

The IANA registry is based on

  [CSP]      West, M. and D. Veditz, "Content Security Policy", n.d.,
              .


I wonder if this [CSP] is stable content?
From the web site, I see
    Content Security Policy Level 3
    Editor’s Draft, 6 November 2015

3 = version?
Editor's draft? Doesn't sound like stable.

The text in draft-west-webappsec-csp-reg-03 considers [CSP] as stable
Ex: It populates the registry with the directives defined in the CSP specification.


Also
      The following table contains the initial values for this registry:

                      +-----------------+-----------+
                      | Directive Name  | Reference |
                      +-----------------+-----------+
                      | base-uri        | [CSP]    |
                      | child-src      | [CSP]    |
                      | connect-src    | [CSP]    |
                      | default-src    | [CSP]    |
                      | font-src        | [CSP]    |
                      | form-action    | [CSP]    |
                      | frame-ancestors | [CSP]    |
                      | frame-src      | [CSP]    |
                      | img-src        | [CSP]    |
                      | media-src      | [CSP]    |
                      | object-src      | [CSP]    |
                      | plugin-types    | [CSP]    |
                      | report-uri      | [CSP]    |
                      | sandbox        | [CSP]    |
                      | script-src      | [CSP]    |
                      | style-src      | [CSP]    |
                      +-----------------+-----------+


Bottom line:
1. should the CSP reference mention?
        Content Security Policy Level 3
        Editor’s Draft, 6 November 2015
2. should the document title mention "Initial assignment for Content Security Policy Directive Registry"?

[Ballot comment]
I'm balloting "yes", but I share Stephen's question about a stable reference for CSP. I note the referenced version is marked "draft" and warns that it may change.

[Ballot comment]

Is the github.io reference for CSP the best one? When I go
there it says http://www.w3.org/TR/CSP3/ is the "latest"
version but that URL gives me a 404. The W3C home page leads
to http://www.w3.org/TR/CSP2/ which I guess is a previous
incarnation of this (albeit from July). I'd suggest that it
might be nice to the reader to include a few of those as
references and to explain (in a sentence) what's what.

(Via drafts-lastcall@iana.org): IESG/Authors/WG Chairs:

IANA has completed its review of draft-west-webappsec-csp-reg-03. If any part of this review is inaccurate, please contact us.

IANA understands that, upon approval of this document, there is a single action which IANA must complete.

The document creates a single new top-level registry called "Content Security Policy Directives." IANA will accordingly create a new category of the same name at http://www.iana.org/protocols. If that name should be broadened to accommodate future related registries, please let us know.

The new registry is managed via the Specification Required policy defined by RFC 5226. These are the initial registrations:

+-----------------+----------------------------------------------+
| Directive Name | Reference |
+-----------------+----------------------------------------------+
| base-uri | [ https://w3c.github.io/webappsec-csp/ ] |
| child-src | [ https://w3c.github.io/webappsec-csp/ ] |
| connect-src | [ https://w3c.github.io/webappsec-csp/ ] |
| default-src | [ https://w3c.github.io/webappsec-csp/ ] |
| font-src | [ https://w3c.github.io/webappsec-csp/ ] |
| form-action | [ https://w3c.github.io/webappsec-csp/ ] |
| frame-ancestors | [ https://w3c.github.io/webappsec-csp/ ] |
| frame-src | [ https://w3c.github.io/webappsec-csp/ ] |
| img-src | [ https://w3c.github.io/webappsec-csp/ ] |
| media-src | [ https://w3c.github.io/webappsec-csp/ ] |
| object-src | [ https://w3c.github.io/webappsec-csp/ ] |
| plugin-types | [ https://w3c.github.io/webappsec-csp/ ] |
| report-uri | [ https://w3c.github.io/webappsec-csp/ ] |
| sandbox | [ https://w3c.github.io/webappsec-csp/ ] |
| script-src | [ https://w3c.github.io/webappsec-csp/ ] |
| style-src | [ https://w3c.github.io/webappsec-csp/ ] |
+-----------------+----------------------------------------------+

IANA understands that this is the only action required to be completed upon approval of this document.

Note:  The actions requested in this document will not be completed until the document has been approved for publication as an RFC. This message is only to confirm what actions will be performed.

The following Last Call announcement was sent out:

From: The IESG
To: IETF-Announce
Reply-To: ietf@ietf.org
Sender:
Subject: Last Call:  (Content Security Policy Directive Registry) to Informational RFC


The IESG has received a request from an individual submitter to consider
the following document:
- 'Content Security Policy Directive Registry'
  as Informational RFC

The IESG plans to make a decision in the next few weeks, and solicits
final comments on this action. Please send substantive comments to the
ietf@ietf.org mailing lists by 2015-11-09. Exceptionally, comments may be
sent to iesg@ietf.org instead. In either case, please retain the
beginning of the Subject line to allow automated sorting.

Abstract


  This document establishes an Internet Assigned Number Authority
  (IANA) registry for Content Security Policy directives.  It populates
  the registry with the directives defined in the CSP specification.




The file can be obtained via
https://datatracker.ietf.org/doc/draft-west-webappsec-csp-reg/

IESG discussion can be tracked via
https://datatracker.ietf.org/doc/draft-west-webappsec-csp-reg/ballot/


No IPR declarations have been submitted directly on this I-D.

1. Summary

Mark Nottingham is Document Shepherd; Barry Leiba is responsible Area
Director.

This document establishes an Internet Assigned Number Authority (IANA)
registry for Content Security Policy directives.  It populates the
registry with the directives defined in the CSP specification.

The target status is Informational.

2. Review and Consensus

This is an AD-sponsored draft to establish a registry for CSP
directives. CSP is defined by the W3C, a product of its consensus
process and widely deployed. Discussion of this draft in the IETF will
occur in Last Call.

3. Intellectual Property

The author has stated that to his direct, personal knowledge, all IPR
related to this document has been disclosed.

4. Other Points

This document does not make downward references.