Subject: [Editorial Errata Reported] RFC7838 (6481)

From: RFC Errata System <[email-masked]>
Date: Fri, 12 Mar 2021 16:23:34 -0800 (PST)

The following errata report has been submitted for RFC7838,
"HTTP Alternative Services".

--------------------------------------
You may review the report below and at:
https://www.rfc-editor.org/errata/eid6481

--------------------------------------
Type: Editorial
Reported by: Lucas Pardue <[email-masked]>

Section: 2.4

Original Text
-------------
   Furthermore, if the connection to the alternative service fails or is
   unresponsive, the client MAY fall back to using the origin or another
   alternative service.  Note, however, that this could be the basis of
   a downgrade attack, thus losing any enhanced security properties of
   the alternative service.

Corrected Text
--------------
 ¯\_(ツ)_/¯

Notes
-----
Alt-Svc fall back is described in section 2.4 and mentions security properties, so I was expecting to see something about fall back in the security considerations. This might be implicitly covered by Section 9.3 but it could potentially be made more clear.

Instructions:
-------------
This erratum is currently posted as "Reported". If necessary, please
use "Reply All" to discuss whether it should be verified or
rejected. When a decision is reached, the verifying party  
can log in to change the status and edit the report, if necessary. 

--------------------------------------
RFC7838 (draft-ietf-httpbis-alt-svc-14)
--------------------------------------
Title               : HTTP Alternative Services
Publication Date    : April 2016
Author(s)           : M. Nottingham, P. McManus, J. Reschke
Category            : PROPOSED STANDARD
Source              : HTTP
Area                : Applications and Real-Time
Stream              : IETF
Verifying Party     : IESG

---

From: Julian Reschke <[email-masked]>
Date: Sat, 13 Mar 2021 11:24:54 +0100

> "HTTP Alternative Services".

I don't think this is an erratum.

The spec says what the WG agreed upon.

If you're looking for a place to collect improvement ideas for a 
potential RFC7838bis, we can do that on the WG's Github issue tracker.

Best regards, Julian

-- 
<green/>bytes GmbH, Hafenweg 16, D-48155 Münster, Germany
Amtsgericht Münster: HRB5782

---

From: Ben Schwartz <[email-masked]>
Date: Mon, 15 Mar 2021 11:14:19 -0400

Re: "RFC7838bis", see https://github.com/MikeBishop/dns-alt-svc/issues/246

On Sat, Mar 13, 2021 at 5:26 AM Julian Reschke <[email-masked]>
wrote:

> > Alt-Svc fall back is described in section 2.4 and mentions security
> properties, so I was expecting to see something about fall back in the
> security considerations. This might be implicitly covered by Section 9.3
> but it could potentially be made more clear.
> >
> > Instructions:
> > -------------

---

From: Lucas Pardue <[email-masked]>
Date: Mon, 15 Mar 2021 15:36:14 +0000

Hey,

On Mon, Mar 15, 2021 at 3:14 PM Ben Schwartz <[email-masked]> wrote:

> On Sat, Mar 13, 2021 at 5:26 AM Julian Reschke <
> [email-masked]> wrote:
>
>> snip
That's a fair point that I'll accept. Where do the HTTP WG collect issues
for documents that they are responsible for before any explicit bis work
has been started? Ben's example is another thing that seems like a good
thing to capture, and I might have another idea in the pipeline.

Cheers,
Lucas

---

From: Julian Reschke <[email-masked]>
Date: Mon, 15 Mar 2021 16:38:39 +0100

Am 15.03.2021 um 16:36 schrieb Lucas Pardue:
> ...
> That's a fair point that I'll accept. Where do the HTTP WG collect
> issues for documents that they are responsible for before any explicit
> bis work has been started? Ben's example is another thing that seems
> like a good thing to capture, and I might have another idea in the pipeline.
 > ...

The simplest possible approach would be to use the http-extensions
github, and create a label such as "rfc7837bis".

Alternatively, we could create a repository exclusively for future work
(but then would need a way to move issues).

Best regards, Julian