Subject: [apps-discuss] Draft -07 meta-proposal: HTTPS and HTTP

From: Tim Bray <[email-masked]>
Date: Sun, 2 Dec 2012 17:15:08 -0800

On Sun, Dec 2, 2012 at 12:21 AM, Paul E. Jones <[email-masked]>wrote:

> With respect to HTTPS, it seems there is strong preference for “HTTPS
> only”, but some a fair bit of insistence for allowing HTTP.  I changed the
> wording in 5.2 to try to capture opinions.  Previously, the text led with a
> requirement to try HTTPS first.  That is still there.  I just added some
> extra conditions that make it clearer that there are some instances where a
> client must not utilize HTTP.  This might need further refinement, but I
> think there is a balance we can strike here between the two camps without
> introducing a lot of complex language.
>

Paul, I think you’re swimming up-hill here.  I detect a
maybe-better-than-rough consensus that the security folk want determinism,
and this language saying “It’s OK to use HTTP except when you shouldn’t” is
probably not going to do it for them.  I heard two realistic proposals to
work around this: HTTP only, and a fallback parameter with deterministic
behavior.  I’m going to write up proposals for both of those (since either
would get my support) and let the WG chairs decide if either or both has
rough-consensus support. -T

> ** **
>
> I made some editorial changes through the document.****
>
> ** **
>
> Comments are welcome, as always.  Seems I don’t need to say that to this
> group, though :-)****
>
> ** **
>
> Paul****
>
> ** **
>
> _______________________________________________
> apps-discuss mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/apps-discuss
>
>