[250] Missing structure and other improvements

[0ndorio]

review phase: 3 level: enhancement type: content ref: 250

The content in 250 is a mess and needs more structure. Some ideas to reorder the sub sections:

• Web sockets should be a standalone paragraph and not part of HTTP.
• JWT should be place next after JSON
• JWT should be place in front of OAuth/OpenID
• HTTPS should follow HTTP or get merged into it.
• container should follow Web Services
• The sub section that mentions the web of trust (right after E-ID) should get merged with the last part of symmetric cryptography which mentions the related information about asymmetric cryptography. It might be useful to split symmetric and asymmetric cryptography.

In general the section is not able to explain for what reason most of the technologies are mentioned. It would drastically improve if you could first explain which feature or property you need or want to achieve and then introduce the related technology and explain why this technology helps to fulfill you goals.

In addition to this it could also be necessary to add a few additional information:

• HTTP is not the transport layer but an application layer protocol.
• HTTP and JWT should both mention that you are not going to use the unencrypted versions.
• You could spend at least a few lines on TLS to improve the description of HTTPS.
• RESTful should atleast once explain what the abbrv. REST.
• The projects mentioned in different paragraphs (i.e. libvirt, Docker, etc.) should have footnotes with an url to the related project.

[lucendio]

partially addressed in https://github.com/lucendio/pdaas_thesis/commit/fd66afc4af1173d0e4a8218596b9d5a40e3e7981

structure

• most suggestions have been applied
• there is no section about web services, thus the contianer section cant follow. I think, you referring to the paragraph about restful. hence containers is now placed subsequently
• https is now tls and follows paragraph about asym crypto

the purpose of this section is to give an overview on different, possibly used technologies. if and how they are actually used is elaborated on in 5xx (and 6xx). I mean it's a chicken-egg problem. at this point of the document it is not clear how everything is going to be (because, this is done mainly in 5xx).

content

• one note about http and app layer: osi is nothing more than just a model and nowadays people tend to implement their own app layer communication on top of it. just because there was a time this particular model was fitting, it doent mean it is still valid. but thats a discussion for another time :)
• forcing encrypted http is aso mentioned later in the thesis; using unencrypted jwt reasonable IMHO, depending on the usecase, and dont forget they are protected by tls
• do you have something particualr in mind? fyi, how parts of TLS work, is described in authentication as well as attack scenarios
• done in foodnote
• fair enough, done (related: #35)