Re: security requirements from Julian Reschke on 2006-10-20 (ietf-http-wg@w3.org from October to December 2006)

From: Julian Reschke <julian.reschke@gmx.de>
Date: Fri, 20 Oct 2006 12:11:24 +0200
To: HTTP Working Group <ietf-http-wg@w3.org>
CC: Paul Leach <paulle@windows.microsoft.com>
Message-ID: <4538A0CC.8010101@gmx.de>

Right Stefan.

To expand even further on that: requiring a MTI security mechanism for a 
theoretical HTTP/1.2 spec may be a good thing. Requiring it for a 
potential revision of HTTP/1.1 IMHO doesn't work, because today there is 
no common approach one could document; that is, a revision would break 
conforming implementations.

But Robert's complaint was triggered by the IESG asking for that kind of 
security mechanism for specs that just happen to *use* HTTP, such as 
AtomPub, CalDAV or XCAP. Those are applications of HTTP, not new protocols.

Best regards, Julian

Received on Friday, 20 October 2006 10:11:32 UTC