- From: Brian Smith <brian@briansmith.org>
- Date: Fri, 15 Aug 2014 11:31:41 -0700
- To: Mark Nottingham <mnot@mnot.net>
- Cc: HTTP Working Group <ietf-http-wg@w3.org>
On Thu, Aug 14, 2014 at 7:58 PM, Mark Nottingham <mnot@mnot.net> wrote:
> Note that most of the justification for our decision not to require https:// for HTTP/2 seems to be predicated on this part of our charter <http://datatracker.ietf.org/wg/httpbis/charter/>:
>
> "The resulting specification(s) are expected to meet these goals for common existing deployments of HTTP[.]"
>
> ... i.e., we're not able to argue that people who can't use https:// should just stay on HTTP/1.1. This charter text was written before BCP188 (and the incidents leading up to it), but has considerable support in the WG.
In the end, it seems like the working group accepted that there will
be times when implementations must fall back to HTTP/1.1, so isn't the
justification you mention above void now? In particular, see this very
recent thread "Feedback on Fallback" started by Mike Bishop and the
"Over-Version" draft it references:
http://lists.w3.org/Archives/Public/ietf-http-wg/2014JulSep/1724.html
http://tools.ietf.org/html/draft-nottingham-http-over-version-00
Consequently, I don't think the shepherd's writeup should say that
requiring authenticated TLS for HTTP/2 was rejected on the grounds
that fallback to HTTP/1.1 is unacceptable, since the group came around
to agreeing that fallback to HTTP/1.1 is indeed a reasonable
compromise sometimes.
Cheers,
Brian
Received on Friday, 15 August 2014 18:32:08 UTC