RE: security requirements (was: Updating RFC 2617 (HTTP Digest) to use UTF-8)

I think if we're talking about mandatory-to-implement
security mechanisms, there actually seems to be some
activity on the topic at

"Web Security Context Working Group

 From our charter: The mission of the Web Security Context
 Working Group is to specify a baseline set of security
 context information that should be accessible to Web users, 
 and practices for the secure and usable presentation of this 
 information, to enable users to come to a better understanding 
 of the context that they are operating in when making trust 
 decisions on the Web."

I would think that mandatory-to-implement security requirements
might depend on the application, and that there might be
a "mandatory-to-implement" policy for "web browsing"
that might not be "mandatory-to-implement" for all
applications of HTTP.

I wonder if the start of this discussion was
in response to "IESG response to the appeal by Robert Sayre"

My understanding of BCPs and policies in general is that
they leave room for judgment.

In any case, appeals to IESG decisions should be made to
the IAB.


Received on Friday, 20 October 2006 06:58:41 UTC