Re: security requirements

On 10/20/06, Paul Leach <paulle@windows.microsoft.com> wrote:
>
> it is a general principle
> of protocol design for any protocol that has options, in order to
> guarantee that conforming implementations can always be configured to
> interoperate. (This was in reaction to the ISO protocol mess with
> non-interoperable "profiles" of the 1980's.)

Oh, I agree that there's certainly a judgement call for Working Groups
to make on this sort of thing. But since the rules concern
implementations rather than deployments, MTI doesn't prevent the
actual threat to HTTP interoperability: centralized authentication
services. It's a backwards rule intended for companies shipping
routers and floppy discs. Web applications can route around it.

--

Robert Sayre