- From: Jonathan Rees <jar@creativecommons.org>
- Date: Sun, 7 Feb 2010 12:00:06 -0500
- To: Tyler Close <tyler.close@gmail.com>
- Cc: www-tag@w3.org, "Mark S. Miller" <erights@google.com>
On Sun, Dec 27, 2009 at 2:20 PM, Tyler Close <tyler.close@gmail.com> wrote: ... > I think the current section 2.7 should be split into two new sections > that correctly address the concerns raised in the current body text. > The first would motivate: > > Good Practice: URI assignment authorities SHOULD NOT put confidential > metadata in a URI whose protocol does not support confidentiality. > > The second section would motivate: > > Good Practice: URI assignment authorities SHOULD identify a > confidential resource using a URI whose protocol provides > confidentiality. > > Good Practice: URI assignment authorities SHOULD identify a > confidential resource using an unguessable URI. > > I am happy to provide body text for these two new sections. I would be interested in seeing this, and hope it meets with better success than my version. > I don't like Jonathan's proposed replacement text, since my impression > is that it only begrudgingly condones the use of unguessable URIs; > whereas I think the TAG should be enthusiastic supporters of them. My approach was tactical, attempting to anticipate the objections that Noah and others would have. My goal was only to draft advice that (unlike the finding) is not at variance with current common practice. I'm certainly not opposed to having URIs used for access control more generally than they are now, but that is a different ambition.
Received on Sunday, 7 February 2010 17:00:41 UTC