Subject: Ben Campbell's Yes on draft-ietf-httpbis-expect-ct-07: (with COMMENT)

From: Ben Campbell <[email-masked]>
Date: Tue, 11 Sep 2018 19:13:18 -0700

Ben Campbell has entered the following ballot position for
draft-ietf-httpbis-expect-ct-07: Yes

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-httpbis-expect-ct/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Thanks for this work. I'm balloting "Yes", but I have a few minor comments.

Substantive:

§2.1, step 6: Is there no room for local policy here?

§2.1.3: The guidance for max-age in the security considerations section
suggests 30 days is a good value. But the directive is specified in seconds.
Does that make sense? Would a 1 second max-age ever be reasonable? Or even 30
days + 1 second?

Editorial:

- General: This uses a non-standard section order towards the end.
Conventionally the last 2 sections should be security considerations and IANA
considerations (although the order between those two varies.)

§2.2.2: The second sentence is about UA behavior. It seems like that belongs
somewhere under §2.3.

§2.3: "SHALL be canonicalized"
By the UA?  (The use of passive voice here obscures the actor.)

---

From: Mark Nottingham <[email-masked]>
Date: Wed, 12 Sep 2018 09:03:37 -0700

Hi Ben,

Just one comment -

> On 11 Sep 2018, at 7:13 pm, Ben Campbell <[email-masked]> wrote:
> 

Pretty much everything in HTTP is done at second granularity; deviating from that would be odd IMO.

Cheers,

--
Mark Nottingham   https://www.mnot.net/

---

From: Mark Nottingham <[email-masked]>
Date: Wed, 12 Sep 2018 09:11:58 -0700

> On 12 Sep 2018, at 9:06 am, Ben Campbell <[email-masked]> wrote:
> 
> Hi Mark,
> 
> Just one comment-question :-)
>>> 

> I certainly don’t have all the HTTP uses of time intervals loaded in my head--are time intervals on the order of “1 month” commonly used elsewhere?

In that sort of syntax, no. The desired semantic is often something like that, but the syntax is almost invariably integer-number-of-seconds.

Cheers,

---

From: Ben Campbell <[email-masked]>
Date: Wed, 12 Sep 2018 11:06:56 -0500

Hi Mark,

> On Sep 12, 2018, at 11:03 AM, Mark Nottingham <[email-masked]> wrote:
> 
> Hi Ben,
> 
> Just one comment -
> 

Ben.

---

From: Ben Campbell <[email-masked]>
Date: Wed, 12 Sep 2018 11:17:25 -0500

> On Sep 12, 2018, at 11:11 AM, Mark Nottingham <[email-masked]> wrote:
> 
> 
> 

I’m not entirely sure I follow, but I think you are saying that it is common to have month-long time intervals that are specified in seconds. Is that correct?

In any case, it’s a non-blocking comment. If there’s good reason (e.g. “the parsers all already understand seconds”) to do this in seconds I’m okay with it.