Re: Op-sec simplification

On 31 October 2016 at 16:32, Kari Hurtta <hurtta-ietf@elmme-mailer.org> wrote:
> Hmm. Reading it from original and from the secured server
> gives little more verify that they really are giving same answers.

Yes, but as I observed, we're never truly certain; there's always a
pathological case where a client can be convinced of the server being
right when it is in fact wrong.  Asking both sides only adds to the
complexity of the solution.

> | GET http://www.example.com/.well-known/http-opportunistic HTTP/1.1
> | Host: www.example.com

Yes, thanks for pointing that out.  Fixed.

Received on Monday, 31 October 2016 09:58:28 UTC