Re: HTTP/2 has mandatory security with optional compliance; violates RFC 2119

On 10 December 2014 at 13:57, Dave Garrett <davemgarrett@gmail.com> wrote:
> 1) It is contradictory to say a security policy MUST be in place, yet MAY be
> enforced. This allows for spec violation and resultant interop problems.

I don't believe that this is a problem at all.  There is a risk of
interoperability failure, but that risk is only conferred to
deployments that fail to comply with the MUST.

We could have avoided ALL of the MUST statements regarding feature use
and ONLY included the MAY regarding INADEQUATE_SECURITY.  That creates
an implicit MUST on all the things the MAY covered.  I don't think
that would be a good idea.

This isn't legislation.  Even there, there are plenty of examples of
legal mandates without a supporting system of enforcement.

I believe that the use of "MAY" is entirely appropriate here.

Received on Wednesday, 10 December 2014 22:10:34 UTC