Subject: Re: [http-state] draft-ietf-httpstate-cookie-01

From: =JeffH <[email-masked]>
Date: Fri, 08 Jan 2010 09:45:02 -0800

draft-abarth-cookie-07 ====> draft-ietf-httpstate-cookie-01   yes?

=JeffH

---

From: Adam Barth <[email-masked]>
Date: Fri, 8 Jan 2010 09:50:38 -0800

Actually draft-ietf-httpstate-cookie-01 is a later build than
draft-abarth-cookie-07 that incorporates a large number of editorial
improvements contributed off-list.  But yes,
draft-ietf-httpstate-cookie-01 is the latest draft.  I don't plan to
put out any more in the draft-abarth-cookie series.

Adam

On Fri, Jan 8, 2010 at 9:45 AM, =JeffH <[email-masked]> wrote:
> _______________________________________________
> http-state mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/http-state
>

---

From: Georg Koppen <[email-masked]>
Date: Tue, 12 Jan 2010 11:02:42 +0100

Hello,

I have found some minor issues concerning the latest draft:

1) Section 4.1.2.2.: "For example, if the domain attribute contains"
should be "For example, if the Domain attribute contains".

2) The same section: "Note that a leading U+2E (".")" should be "Note
that a leading U+002E (".")"

3) The same section: "the user agent will return the cookie only to the
origin server" should be "the user agent will return the cookie only to
the origin server."

4) Section 4.2.1.: "a Cookie header that conforms to the following
grammar." should be "a Cookie header that conforms to the following
grammar:"

5) Section 5 says that there are some algorithms specified for some
tasks concerning the cookie protocol but the user agents do not have to
follow these ("user agents are free to implement the cookie
protocol..."). But, for instance in Section 5.1.1., there it says "The
user agent MUST use the following algorithm..." Thus, am I free to
implement it differently or not? It's a bit confusing...

6) Section 5.2.: Point 2.: "Otherwise: The name-value-pair string
consists of all the character" should be: "Otherwise: The
name-value-pair string consists of all the characters"

7) Section 7.1.: "In addition to encrypting and signing the the
contents" Well, one "the" should be enough, shouldn't it. ;-)

Georg

---

From: Adam Barth <[email-masked]>
Date: Tue, 12 Jan 2010 02:34:07 -0800

> should be "For example, if the Domain attribute contains".

Fixed.

> that a leading U+002E (".")"

Fixed.

> origin server" should be "the user agent will return the cookie only to

Fixed.

> grammar." should be "a Cookie header that conforms to the following

Fixed.

> implement it differently or not? It's a bit confusing...

The operative requirement is:

      <t>Although some parts of the cookie protocol are specified
      algorithmically, user agents are free to implement the cookie protocol
      in any manner as long as their resultant behavior is "black-box"
      indistinguishable from a user agent that implements the protocol as
      described.</t>

Is there some way we can be clearer that user agents are free to
implement the protocol however they like?  This might be a slight
cultural divide.  Many user agent specifications are written in this
way.

> name-value-pair string consists of all the characters"

Fixed.

> contents" Well, one "the" should be enough, shouldn't it. ;-)

Already fixed.

Thanks for your careful reading!

Adam

---

From: Georg Koppen <[email-masked]>
Date: Tue, 12 Jan 2010 11:54:46 +0100

Hello again,

> implement the protocol however they like?  

Why MUST the user use these algorithms? Wouldn't it be enough if the
user MAY use them? I mean, they are free to implement the protocol
however they want to do it, provided they come to the same results.

Georg

---

From: Adam Barth <[email-masked]>
Date: Tue, 12 Jan 2010 03:00:36 -0800

> however they want to do it, provided they come to the same results.

The goal is to require that they come up with the same results.  I
guess we could say something more elaborate each time.  It just seems
a bit wordy.  Any suggestions for text to use?

Adam

---

From: Ian Hickson <[email-masked]>
Date: Tue, 12 Jan 2010 11:44:04 +0000 (UTC)

> a bit wordy.  Any suggestions for text to use?

HTML5 uses:

# Conformance requirements phrased as algorithms or specific steps may be 
# implemented in any manner, so long as the end result is equivalent. (In 
# particular, the algorithms defined in this specification are intended to 
# be easy to follow, and not intended to be performant.)

 -- 
Ian Hickson               U+1047E                )\._.,--....,'``.    fL
http://ln.hixie.ch/       U+263A                /,   _.. \   _\  ;`._ ,.
Things that are impossible just take longer.   `._.-(,_..'--(,_..'`-.;.'

---

From: Adam Barth <[email-masked]>
Date: Tue, 12 Jan 2010 15:59:26 -0800

> # be easy to follow, and not intended to be performant.)

Thanks.  I've replaced the existing paragraph with this text.

Adam