Subject: Re: [Editorial Errata Reported] RFC7230 (4136)

From: Barry Leiba <[email-masked]>
Date: Mon, 20 Oct 2014 20:25:45 -0400

Julian, Roy... is that item meant to refer to what's in 3.3.3 bullet
5, or does it refer to something else?

Barry

On Mon, Oct 20, 2014 at 6:29 PM, RFC Errata System
<[email-masked]> wrote:
> The following errata report has been submitted for RFC7230,
> "Hypertext Transfer Protocol (HTTP/1.1): Message Syntax and Routing".
>
> --------------------------------------
> You may review the report below and at:
> http://www.rfc-editor.org/errata_search.php?rfc=7230&eid=4136
>
> --------------------------------------
> Type: Editorial
> Reported by: Frank Gevaerts <[email-masked]>
>
> Section: A.2.
>
> Original Text
> -------------
> Bogus Content-Length header fields are now required to be handled as
> errors by recipients.  (Section 3.3.2)
>
>
> Corrected Text
> --------------
> Bogus Content-Length header fields are now required to be handled as
> errors by recipients.  (Section 3.3.3)
>
>
> Notes
> -----
> The mentioned requirement appears in 3.3.3 (5), not in 3.3.2
>
> Instructions:
> -------------
> This erratum is currently posted as "Reported". If necessary, please
> use "Reply All" to discuss whether it should be verified or
> rejected. When a decision is reached, the verifying party (IESG)
> can log in to change the status and edit the report, if necessary.
>
> --------------------------------------
> RFC7230 (draft-ietf-httpbis-p1-messaging-26)
> --------------------------------------
> Title               : Hypertext Transfer Protocol (HTTP/1.1): Message Syntax and Routing
> Publication Date    : June 2014
> Author(s)           : R. Fielding, Ed., J. Reschke, Ed.
> Category            : PROPOSED STANDARD
> Source              : Hypertext Transfer Protocol Bis
> Area                : Applications
> Stream              : IETF
> Verifying Party     : IESG
>

---

From: Julian Reschke <[email-masked]>
Date: Tue, 21 Oct 2014 07:44:54 +0200

> 5, or does it refer to something else?

No, the RFC text is correct. We are really talking about 3.3.2.

Best regards, Julian

---

From: Jim Manico <[email-masked]>
Date: Tue, 21 Oct 2014 02:22:30 -0400

Now that SSL 3.0 is dead due to POODLE, is there any chance it can be removed from the HTTP2 spec? It's security theatre at best right now.

Aloha,
--
Jim Manico
@Manicode
(808) 652-3805

---

From: Martin Thomson <[email-masked]>
Date: Mon, 20 Oct 2014 23:53:00 -0700

> Now that SSL 3.0 is dead due to POODLE, is there any chance it can be removed from the HTTP2 spec? It's security theatre at best right now.

It's already gone.  As is TLS 1.0 and 1.1.

---

From: Matthew Kerwin <[email-masked]>
Date: Tue, 21 Oct 2014 16:49:38 +1000

On 21 October 2014 16:22, Jim Manico <[email-masked]> wrote:

> Now that SSL 3.0 is dead due to POODLE, is there any chance it can be
> removed from the HTTP2 spec? It's security theatre at best right now.
>
>
​I didn't think SSL (any version) was in the HTTP/2 spec.​

-- 
  Matthew Kerwin
  http://matthew.kerwin.net.au/

---

From: Jim Manico <[email-masked]>
Date: Tue, 21 Oct 2014 03:22:33 -0400

My apologies, excellent news!

Aloha,
--
Jim Manico
@Manicode
(808) 652-3805

> On Oct 21, 2014, at 2:53 AM, Martin Thomson <[email-masked]> wrote:
>

---

From: Julian Reschke <[email-masked]>
Date: Tue, 21 Oct 2014 10:56:28 +0200

On 2014-10-21 08:49, Matthew Kerwin wrote:
> On 21 October 2014 16:22, Jim Manico <[email-masked]
> <mailto:[email-masked]>>wrote:
>
>     Now that SSL 3.0 is dead due to POODLE, is there any chance it can
>     be removed from the HTTP2 spec? It's security theatre at best right now.
>
>
> ...

Nor in HTTP/1.1...

Best regards, Julian

---

From: Jim Manico <[email-masked]>
Date: Tue, 21 Oct 2014 07:56:26 -0400

Forgive my ignorance with this question. Will another memo/standard/RFC be needed (such as http://tools.ietf.org/html/rfc2818) to explain the relationship between HTTP/2 and TLS?

--
Jim Manico
@Manicode
(808) 652-3805

> On Oct 21, 2014, at 4:56 AM, Julian Reschke <[email-masked]> wrote:
>

---

From: "Walter H." <[email-masked]>
Date: Tue, 21 Oct 2014 14:26:12 +0200

between something is not recommended due to security risks and something
is not possible due to a not existing standard is a difference;

before thinking of removing old stuff from new standards its better to
think of not adding not neccessary features.

---

From: Barry Leiba <[email-masked]>
Date: Tue, 21 Oct 2014 08:27:27 -0400

That was my sense from re-reading it now, as well.  I will mark this report
as "Rejected", with a note that the comment refers to Section 3.3.2 as a
whole.

Barry

---

From: Martin Thomson <[email-masked]>
Date: Tue, 21 Oct 2014 06:13:05 -0700

> Forgive my ignorance with this question. Will another memo/standard/RFC be needed (such as http://tools.ietf.org/html/rfc2818) to explain the relationship between HTTP/2 and TLS?

No new work, it's baked in: http://http2.github.io/http2-spec/#TLSUsage