Subject: [lemonade] draft -01 of the URLAUTH document

From: Mark Crispin <[email-masked]>
Date: Thu, 23 Sep 2004 13:21:09 -0700 (PDT)

This document has relatively minor editorial changes that I made last July 
but apparently did not post.  As far as I know, it addresses all the 
pending issues to the URLAUTH document that have been called to my 
attention.

Since there is going to be an interim Lemonade meeting on October 12, I 
assume that anything that's needed for draft -02 will come out there, and 
I expect to get it posted by the October 25 cutoff for the Washington DC 
IETF meeting.

I call the WG's attention in particular to the following discussion item:

;;; Earlier versions of this document had access identifiers for "any
;;; authorized user" and anonymous.  These were not needed for Lemonade
;;; submit-without-download and were removed.  Should something of this
;;; nature be put back in?

I also want to call attention to the named mechanism capability.  The 
intent of this is to make it possible for other applications to have 
client-generated URLAUTHs as was envisioned in the earlier drafts.  This 
also was not needed for Lemonade submit-without-download, and was removed.

In both cases, the removal was to neutralize security objections to the 
overall specification.  It was clear that many people were uncomfortable 
with Lemonade endorsing a model which required "any authorized user" and 
anonymous access identifiers, as well as client-generated URLAUTHs.

The question is, now that these requirements are gone, and we seem to be 
satisfied that the required provisions are secure, is it possible to add 
these as optional facilities?  Or should this possibility be shelved until 
after the current URLAUTH is finished, to be offered as extensions by 
after Lemonade concludes its work?

As far as I'm concerned, it's whatever is the path of least resistance.

-- Mark --

http://staff.washington.edu/mrc
Science does not emerge from voting, party politics, or public debate.
Si vis pacem, para bellum.

_______________________________________________
lemonade mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/lemonade