Skip to content

remove normative language from Security Considerations #231

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Aug 14, 2025
+9 −9
Merged

remove normative language from Security Considerations #231

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
432c11c
remove normative language from Security Considerations
pchampin Aug 8, 2025
7a24817
Update spec/index.html
pchampin Aug 11, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 9 additions & 9 deletions spec/index.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2002,7 +2002,7 @@ <h2>Security Considerations</h2>
<p>The RDF Abstract Syntax is not used directly for conveying information,
although concrete serialization forms are specifically intended to do so.</p>

<p>Applications MAY evaluate given data to infer more assertions or to dereference <a>IRIs</a>,
<p>Applications can evaluate given data to infer more assertions or to dereference <a>IRIs</a>,
invoking the security considerations of the scheme for that IRI.
Note in particular, the privacy issues in [[RFC3023]] section 10 for HTTP IRIs.
Data obtained from an inaccurate or malicious data source may lead to inaccurate or misleading conclusions,
Expand All @@ -2016,26 +2016,26 @@ <h2>Security Considerations</h2>
security considerations will vary by domain of use.
Security tools and protocols applicable to text
(for example, PGP encryption, checksum validation, password-protected compression)
may also be used on RDF documents.
Security/privacy protocols must be imposed which reflect the sensitivity of the embedded information.</p>
can also be used on RDF documents.
Security/privacy protocols ought to be imposed which reflect the sensitivity of the embedded information.</p>

<p>RDF can express data which is presented to the user, such as RDF Schema labels.
Applications rendering <a>strings</a> retrieved from untrusted RDF documents,
or using unescaped characters,
SHOULD use warnings and other appropriate means to limit the possibility
are encouraged to use warnings and other appropriate means to limit the possibility
that malignant strings might be used to mislead the reader.
The security considerations in the media type registration for XML ([[RFC3023]] section 10)
provide additional guidance around the expression of arbitrary data and markup.</p>

<p>RDF uses <a>IRIs</a> as term identifiers.
Applications interpreting data expressed in RDF SHOULD address the security issues of
Applications interpreting data expressed in RDF ought to address the security issues of
[[[RFC3987]]] [[RFC3987]] Section 8, as well as
[[[RFC3986]]] [[RFC3986]] Section 7.</p>

<p>Multiple <a>IRIs</a> may have the same appearance.
Characters in different scripts may look similar (for instance,
a Cyrillic &quot;&#1086;&quot; may appear similar to a Latin &quot;o&quot;).
A character followed by combining characters may have the same visual representation
<p>Multiple <a>IRIs</a> can have the same appearance.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These last four changes are not needed and, in my opnion, are less readable than the unchanged text.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

(this part of the PR isn't in the "preview" or "diff")

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@afs — I see these four lines (2035-2038) in both Preview and Diff. Perhaps try searching for Characters in different? These lines are less obvious in the rendered pages than in the HTML source, because the HTML source has new lines that get folded into spaces in the rendered page.

@pfps — It's easier to know what "last four changes" you're talking about if you drag-select the plus-sign from the first line of concern down to the last line of concern. This also allows for easy suggestion of changes to the source, where I would currently have to start a new thread to insert such suggestion about all 4 of these lines.

Characters in different scripts can look similar (for instance,
a Cyrillic &quot;&#1086;&quot; can appear similar to a Latin &quot;o&quot;).
A character followed by combining characters can have the same visual representation
Comment on lines +2035 to +2038
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I support the changes from may to can in these four lines (2035–2038).

as another character (for example, LATIN SMALL LETTER "E" followed by COMBINING ACUTE
ACCENT has the same visual representation as LATIN SMALL LETTER "E" WITH ACUTE).
Any person or application that is writing or interpreting data in RDF
Expand Down
Loading