Subject: Re: [websec] Gen-ART LC Review of draft-ietf-websec-strict-transport-sec-11

From: =JeffH <[email-masked]>
Date: Fri, 10 Aug 2012 14:33:55 -0700

Thanks Ben.

 > Jeff and I had a f2f discussion about this point in Vancouver. To paraphrase
 > (and I assume he will correct me if if I mischaracterize anything), Jeff
 > indicated that this really wasn't a MUST level requirement due to the
 > variation and vagaries in application behavior and abilities.

Yes, see the NOTE in section 7.2.

 > Rather, it's
 > more of a "do the best you can" sort of thing. Specifically, he indicated
 > that an implementation that chose to go ahead and serve unprotected content
 > due to the listed caveats on redirecting to HTTPS would necessarily be
 > out-of-compliance.

I presume you actually mean "not necessarily", which would then be correct, 
unless I'm misunderstanding something.

 > If the requirement really that you SHOULD NOT (rather than MUST NOT) serve
 > unprotected content, then I think the original language is okay.

agreed.

thanks,

=JeffH

---

From: Ben Campbell <[email-masked]>
Date: Fri, 10 Aug 2012 16:55:47 -0500

On Aug 10, 2012, at 4:33 PM, =JeffH <[email-masked]> wrote:

> I presume you actually mean "not necessarily", which would then be correct, unless I'm misunderstanding something.

Oops, you are correct, that's a typo.

> _______________________________________________
> Gen-art mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/gen-art