Subject: [http-auth] Ben Campbell's No Objection on draft-ietf-httpauth-scram-auth-15: (with COMMENT)

From: "Ben Campbell" <[email-masked]>
Date: Wed, 16 Dec 2015 15:52:59 -0800

Ben Campbell has entered the following ballot position for
draft-ietf-httpauth-scram-auth-15: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-httpauth-scram-auth/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Can you say something about why this is experimental? That is, what is
the nature of the experiment? Will results be reported? Is there a need
for deployment experience? Do you expect this to progress to standards
track at some point in the future?

---

From: Stephen Farrell <[email-masked]>
Date: Wed, 16 Dec 2015 23:57:36 +0000

> https://datatracker.ietf.org/doc/draft-ietf-httpauth-scram-auth/

See the charter of the http-auth wg. [1] All of the RFCs
from this WG are experimental for the same reason, which
is basically that browsers today don't want new HTTP
authentication schemes (they probably don't want the old
ones too;-)

S.

[1] https://tools.ietf.org/wg/httpauth/charters

---

From: "Ben Campbell" <[email-masked]>
Date: Wed, 16 Dec 2015 18:14:09 -0600

> authentication schemes (they probably don't want the old

Ah, got it. That's good enough for me.

---

From: "Roy T. Fielding" <[email-masked]>
Date: Wed, 16 Dec 2015 16:20:33 -0800

> On Dec 16, 2015, at 3:57 PM, Stephen Farrell <[email-masked]> wrote:

I realize that was written into the charter (to satisfy someone's personal opinion),
but it isn't even remotely true that browsers aren't interested in new authentication
schemes on the standards track, and even if it were true it wouldn't matter: browsers
make up less than 1% of HTTP implementations.  The whole point of having extensible
authentication schemes is to allow them to be defined and developed independently of
"current practice".  And the point of having an initial standards track of Proposed
is to make clear they are proposals that are not necessarily deployed.

More useless procedural pain for no gain.

....Roy

---

From: Stephen Farrell <[email-masked]>
Date: Thu, 17 Dec 2015 00:31:08 +0000

On 17/12/15 00:20, Roy T. Fielding wrote:
> schemes on the standards track, 

I said HTTP authentication schemes. I have seen zero evidence that
browsers are interested in those. I'd be happy if they were. Can
you point at some?

> and even if it were true it wouldn't matter: browsers
> make up less than 1% of HTTP implementations.  

Hmm. I don't at all agree that it doesn't matter if browser makers
do or do not want to adopt some technology. But that they don't like
something is not a sufficient reason to not do that thing, I hope
we do agree about that.

> The whole point of having extensible
> "current practice".  

I agree that defining things that are better than basic and digest
is worthwhile. (Hence my working on RFC 7486 and an implementation
thereof.)

> And the point of having an initial standards track of Proposed

What pain? Experimental vs. PS makes no real procedural difference to
the authors. Except it maybe gets some folks off their backs in a case
like this.

S.