Subject: Re: IPP> Use of SSL3 Framing????

From: Bob Van Andel <[email-masked]>
Date: Thu, 6 Nov 1997 09:18:57 -0500

Randy,

>The fact that scenarios exist where security is not
>necessary, do not obviate the need for the standard
>to specify security as a requirement. Its possible
>that one of the machines in one of these scenarios
>might be moved or requested to communicate outside
>of the scenario-specific domain and we don't want
>to have to modify the configuration or install new
>software in order to interoperate.
>
<snip>

Existing Web browsers and servers make the transition from insecure
(non-SSL3) to secure (SSL3) modes and back all the time.  Why can't IPP
clients dynamically negotiate those transitions for those environments
where the site configuration warrants it.

I would expect that a number of site configuration issues will be necessary
that don't require software changes to interoperate, but do require
administrative attention.  Why is this different than the administrator
configuring which bin has letterhead?  I'm assuming that the IPP spec
allows a printer with a single paper source to ignore multi-tray attributes.

Bob

----------------------------------------
Bob Van Andel
Allegro Software Development Corporation
43 Waite Road
Boxborough, MA  01719
(978) 266-1375
(978) 266-2839 fax

Information on the RomPager embedded web server toolkit is at
<http://www.allegrosoft.com/>

---

From: Larry Masinter <[email-masked]>
Date: Thu, 6 Nov 1997 14:06:30 PST

> They are required by de facto, not by a pure standard, to support HTTPS
> because no commercial vendor of HTTP servers would introduce a server
> incapable of providing the capability for internet commerce.

This is utterly false. Not all HTTP servers are required to support Internet
commerce. 
-- 
http://www.parc.xerox.com/masinter

---

From: "Turner, Randy" <[email-masked]>
Date: Thu, 6 Nov 1997 14:11:05 -0800

Let me emphasize the word "de facto", because I can't think of any HTTP
server shipping today that doesn't support HTTPS (Netscape Enterprise
Server, Microsoft IIS, Apache). The question was whether or not there is
some requirement, and there is no STANDARD requirement that HTTP servers
support
SSL3, but there is a very strong MARKET requirement for this type of
support.

Randy

> -----Original Message-----
> From:	Larry Masinter [SMTP:[email-masked]]
> Sent:	Thursday, November 06, 1997 2:07 PM
> To:	Randy Turner
> Cc:	Harry Lewis; [email-masked]
> Subject:	Re: IPP> Use of SSL3 Framing????
>

---

From: Carl-Uno Manros <[email-masked]>
Date: Thu, 6 Nov 1997 14:49:29 PST

Randy,

You seem to think only about web server vendors. There are a number of
other HTTP implementations, in particular for embedding in devices (such as
printers) that are counting every bit they put in.

Carl-Uno

>> This is utterly false. Not all HTTP servers are required to support
Carl-Uno Manros
Principal Engineer - Advanced Printing Standards - Xerox Corporation
701 S. Aviation Blvd., El Segundo, CA, M/S: ESAE-231
Phone +1-310-333 8273, Fax +1-310-333 5514
Email: [email-masked]