Subject: Re: HTTPBis BOF followup - should RFC 2965 (cookie) be in scope for the WG?

From: "Yngve N. Pettersen (Developer Opera Software ASA)" <[email-masked]>
Date: Sun, 02 Sep 2007 17:19:53 +0200

Hello Stefanos,

On Tue, 28 Aug 2007 19:44:10 +0200, Stefanos Harhalakis <[email-masked]>  
wrote:

>
> On Tuesday 28 August 2007, Stefanos Harhalakis wrote:
>> On Monday 27 August 2007, Alexey Melnikov wrote:
>>
>> I don't know if I'm supposed to vote, but I'd suggest 1 (No). The  
>> rationale
>> can be summarized in the question: "Why yes?".
>
>  Sorry for replying to self but I'd like to change that to 4:
> Discuss it in the list first.
>
>   Then, maybe vote for '3'.
>
>   After reading the minutes (again), I understand that this will only  
> change
> RFC 2695 to 'become' the Netscape doc. So, I don't actually see it as a  
> hi
> priority issue, thinking that a well accepted document already exists
> (Netscape) and there is no confusion. Also, shouldn't this become a new  
> RFC
> that will replace 2695?

I think you misunderstand the intention of my I-D  
draft-pettersen-cookie-v2 , and my presentation at the BoF.

The intention of the draft is to fix security and privacy issues in both  
the Netscape spec and RFC 2965 (the "cookie monster bug") by changing the  
domain and path semantics, so that the issues with Netscape and RFC 2965  
cannot occur, and as a result obsoleting Netscape and RFC 2965 cookies.

I have also posted two other drafts suggesting candidates for intermediate  
workarounds that I believe will reduce the problem in the existing  
specifications.

For more information about the background please see my articles

   http://my.opera.com/yngve/blog/show.dml/267415
   http://my.opera.com/yngve/blog/show.dml/388840

-- 
Sincerely,
Yngve N. Pettersen
 
********************************************************************
Senior Developer                     Email: [email-masked]
Opera Software ASA                   http://www.opera.com/
Phone:  +47 24 16 42 60              Fax:    +47 24 16 40 01
********************************************************************

---

From: Alexey Melnikov <[email-masked]>
Date: Wed, 05 Sep 2007 20:03:58 +0100

Alexey Melnikov wrote:

> Hi folks,
> Answers to this question during the BOF were not conclusive, so I 
> would like to poll mailing list members on whether revision of RFC 
> 2965 (HTTP State Management Mechanism) should be in scope for the 
> proposed WG.
>
> Question: Should RFC 2965 revision be in scope for the WG?
>
> Please chose one of the following answers:
>
> 1). No
> 2). Yes
> 3). Maybe (this includes "yes, but when the WG completes the currently 
> proposed milestones" and "yes, but this should be done in another WG")
> 4). I have another opinion, which is ....
>
> Please send answers to the mailing list, or directly to me *and* Mark 
> Nottingham <[email-masked]>.
> And of course feel free to ask clarifying questions/correct list of 
> answers.

I've reviewed replies with Mark and here are the results:

No - 2 people
Yes - 2 people (or 4 people, as 2 replied "Yes/Maybe")
Maybe - 7 people (or 5 people if you exclude the 2 who said yes/maybe)

So consensus seems to be in favor of "Maybe" with very slight bias 
toward Yes.