Subject: Re: WG Review: Recharter of Hypertext Transfer Protocol Bis (httpbis)

From: Peter Saint-Andre <[email-masked]>
Date: Thu, 01 Mar 2012 10:50:33 -0700

<hat type='AD'/>

On 2/21/12 11:10 AM, IESG Secretary wrote:
> A modified charter has been submitted for the Hypertext Transfer 
> Protocol Bis (httpbis) working group in the Applications Area of the 
> IETF.  The IESG has not made any determination as yet.  The modified 
> charter is provided below for informational purposes only.  Please send 
> your comments to the IESG mailing list ([email-masked]) by Tuesday, 
> February 28, 2012.

Clearly this rechartering request has triggered a lengthy discussion
about web authentication. However, the only comment on the charter
itself Stephen Farrell's noting that this bullet is a bit vague
(specifically that it does not mention authentication):

> * Reflecting modern security requirements and practices

Stephen and I just had a chat about this matter. He and I came up with a
proposed paragraph to add after that list of bullet points:

   In the initial phase of work on HTTP/2.0, new proposals
   for authentication schemes can be made.  The WG will
   select zero or more of those with a goal of choosing
   at least one scheme that is better than those available
   for HTTP/1.x.  Non-selected schemes might be discussed
   with the IETF Security Area for further work there.

Your comments are welcome.

Peter

-- 
Peter Saint-Andre
https://stpeter.im/

---

From: Tim Bray <[email-masked]>
Date: Thu, 1 Mar 2012 09:57:39 -0800

+1

On Thu, Mar 1, 2012 at 9:50 AM, Peter Saint-Andre <[email-masked]> wrote:
> _______________________________________________
> Ietf mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ietf

---

From: SM <[email-masked]>
Date: Thu, 01 Mar 2012 10:05:19 -0800

>    with the IETF Security Area for further work there.

If the WG selects zero, how can it meet the goal of choosing at least 
one scheme?

Regards,
-sm

---

From: Peter Saint-Andre <[email-masked]>
Date: Thu, 01 Mar 2012 11:40:57 -0700

> If the WG selects zero, how can it meet the goal of choosing at least

One can have a goal of choosing a scheme that's better, but if no one
proposes any or none of the selected schemes are deemed better, then we
will not achieve the goal. Perhaps that thought could be worded more
clearly.

Peter

-- 
Peter Saint-Andre
https://stpeter.im/

---

From: Peter Saint-Andre <[email-masked]>
Date: Thu, 01 Mar 2012 11:43:47 -0700

[ no hat ]

On 3/1/12 11:01 AM, Nick Hilliard wrote:
> On 01/03/2012 17:50, Peter Saint-Andre wrote:
> Can I suggest you also include authorization capabilities as a core
> component of this. It's not much use to have people able to authenticate
> themselves to a system if that system doesn't also provide a framework for
> allowing the server-side application decide what they can or cannot do.

Feel free to include that in your proposal. :)

Peter

-- 
Peter Saint-Andre
https://stpeter.im/

---

From: Paul Hoffman <[email-masked]>
Date: Thu, 1 Mar 2012 11:08:01 -0800

> allowing the server-side application decide what they can or cannot do.

This is a request for an HTTP capability that is significantly different than what has been proposed before, and has not been one of the items that caused problems in HTTP 1.x. I suggest that this not be part of the charter for httpbis until it can be shown to be a significant need, not just a new idea.

--Paul Hoffman

---

From: Paul Hoffman <[email-masked]>
Date: Thu, 1 Mar 2012 11:09:15 -0800

On Mar 1, 2012, at 10:05 AM, SM wrote:

> If the WG selects zero, how can it meet the goal of choosing at least one scheme?

It doesn't, of course. If the WG doesn't meet that goal, it will be clear at the time, and the WG can ask to recharter for that limited purpose.

--Paul Hoffman

---

From: Mark Nottingham <[email-masked]>
Date: Fri, 2 Mar 2012 09:09:20 +1100

WFM. Thanks, Peter.

--
Mark Nottingham   http://www.mnot.net/