Subject: Éric Vyncke's No Objection on draft-ietf-httpbis-bcp56bis-14: (with COMMENT)

From: Éric Vyncke via Datatracker <[email-masked]>
Date: Wed, 25 Aug 2021 07:53:03 -0700

Éric Vyncke has entered the following ballot position for
draft-ietf-httpbis-bcp56bis-14: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-httpbis-bcp56bis/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Thank you for the work put into this document, which is also easy and
interesting to read.

Please find below some non-blocking COMMENT points (but replies would be
appreciated even if only for my own education).

Special thanks to Tommy Pauly for his shepherd's write-up notably about the WG
consensus.

I hope that this helps to improve the document,

Regards,

-éric

-- Section 2 --
I am puzzled by the wording " The requirements in this document" in this BCP...
Should it rather be "The applicability of this document..." ?

The following bullet list is unclear whether it is a "OR" or a "AND".

-- Section 3.2 --
s/Another common practice/Another common mistake/ ?

Some examples would be welcome as well.

-- Section 4.4.2 --
Isn't the reference to RFC 7258 redundant in ""https" is RECOMMENDED to provide
authentication, integrity and confidentiality, as well as mitigate pervasive
monitoring attacks [RFC7258]." ?

-- Section 4.5 --
In "they are required to be registered" should normative "REQUIRED" be used ?

Also, possibly naively, surprised by the absence of the "POST" method in the
list of detailed methods.

---

From: Mark Nottingham <[email-masked]>
Date: Thu, 26 Aug 2021 11:04:31 +1000

Hi Éric,

Thanks for the feedback. Responses below.

> On 26 Aug 2021, at 12:53 am, Éric Vyncke via Datatracker <[email-masked]> wrote:
> 
> -- Section 2 --

That would result in a construction like 'the applicability of this document is scoped to applications' which is a bit odd.

> The following bullet list is unclear whether it is a "OR" or a "AND".

Each entry (excepting the last) explicitly contains the word 'or'.

> s/Another common practice/Another common mistake/ ?

No - that practice is legitimate for non-standard applications.

> Some examples would be welcome as well.

A full example would increase the size of this section considerably, and I don't think we're quite ready to recommend specific practices here, beyond what RFC8288 does -- HTTPAPI is working on some ideas.

> monitoring attacks [RFC7258]." ?

I don't think so.

> In "they are required to be registered" should normative "REQUIRED" be used ?

They aren't required by this document, they're required by HTTP.

> list of detailed methods.

Yeah, I know. We didn't come up with any text that was especially illuminating about it, so we left it out. 

Cheers,

--
Mark Nottingham   https://www.mnot.net/

---

From: Mark Nottingham <[email-masked]>
Date: Thu, 26 Aug 2021 17:06:46 +1000

> On 26 Aug 2021, at 4:23 pm, Eric Vyncke (evyncke) <[email-masked]> wrote:
> 
>> -- Section 2 --
> EV> "applicability" will not fly but I still think that "the requirements in this documents" does not fit a BCP. What about a last try "The recommendations in this document apply when..." ?

Excellent. See <https://github.com/httpwg/http-extensions/commit/edd7ac7f1>.

> EV> indeed... it looks like that I may need new glasses ...

I am familiar with that feeling...

Cheers,