Subject: [Insipid] comments on

From: "Charles Eckel (eckelcu)" <[email-masked]>
Date: Sun, 4 Nov 2012 00:43:59 +0000

I read the draft and think this version is a good step forward. Paul K. and Salvatore already raised most of the comments I had in mind, but I have the following which may still be of some value.

Section 4 reads as follows:

  Consider the following example.

   Endpoint 1 produces this UUID: 0xaeffa652b22911dfa81f12313a006823
   Endpoint 2 produces this UUID: 0xbe11afc8b22911df86c412313a006823

   The resulting concatenated Session Identifier would be:
   0xaeffa652b22911dfa81f12313a006823be11afc8b22911df86c412313a006823

This is no longer true and does not align with the new ABNF (i.e. the addition of the rcvr parameter).

My other comment is in regard to:
http://www.ietf.org/mail-archive/web/insipid/current/msg00402.html

ISTM that a session id aware intermediary should insert a uuid when not present on behalf on either the endpoint. It might help to enumerate all cases explicitly:

a) Alice includes a session-id and Bob does too 
Yeah, the intermediary does not alter anything
b) Alice includes a session-id and Bob does not
Intermediary inserts a session-id in the response on behalf of Bob
c)  Alice does not include a session-id and Bob does
Intermediary inserts a session-id in the request on behalf of Alice
d) Alice does not include a session-id and Bob does not either
Intermediary inserts a session-id in the request on behalf of Alice and in the response on behalf of Bob

Cheers,
Charles