Re: Moving forward on improving HTTP's security

On 13 Nov 2013, at 8:42 pm, Julian Reschke <julian.reschke@gmx.de> wrote:

> To be clear: my main concern here is not the actual bits on the wire, but ruling out use of HTTP/2.0 for "http:" URIs.

And the *precise* language around that is still TBD. I�m somewhat of a mind to not specify it at all, in that the implementations will naturally do this anyway, but since the strongest indications we have is that people want us to do *something*, those requirements may fulfil that role.

> As far as I can tell, what you are proposing is not what has been discussed during the actual working group meeting.

Your understanding of what happened seems like it�s different than the other people who I�ve spoken to. Regardless of that, however, we don�t need to discuss every option at physical meetings; we need to discuss them on the list. That�s what�s happening now.

> We had several hums, and as far as I can tell, we had not even rough consensus for any of these options. The weakest "[ weakest for can't live with ]" outcome is recorded for option 3, not 4.

Hums are not a means of judging consensus; they�re a means for the chair to gather information about the people in the room � nothing more. As a reminder, we make decisions in the IETF based upon technical merit, not voting.

I am very aware that we didn�t have ample time to discuss this issue in our Vancouver meeting. I doubt that having had two extra days (never mind hours) would have helped, and we wouldn�t have learned significantly more information even if we had them, since the positions were so divided. 

As a result, I�m making an informed judgement call, based upon discussions so far and the options available to us. I do not do so lightly, and have been in active consultation with many of those it will affect, as well as IETF leadership. If that call is wrong, I�m confident that the WG will correct it, but again, that is *not* voting.

> Apparently, this needs more discussion.

Of course. I�ve announced what I believe our current state is; if there is serious pushback that has technical merit, we�ll have to revisit it. And as I�ve said many times, I�m open to proposals � especially those that can a) gain consensus b) actually get implemented and c) get approved by the whole IETF community. Haven�t seen any others yet.

Regards,

--
Mark Nottingham   http://www.mnot.net/

Received on Wednesday, 13 November 2013 13:15:35 UTC