Subject: [websec] #55: Clarify that the newest pinning information takes precedence

From: "websec issue tracker" <[email-masked]>
Date: Fri, 19 Oct 2012 21:33:00 -0000

#55: Clarify that the newest pinning information takes precedence

 In section "Interactions With Preloaded Pin Lists", we need to specify
 that the newest information, even "stop pinning", must take precedence. I
 propose this text:

 UAs MUST use the newest information — built-in or set via Valid Pinning
 Header — when performing Pin Validation for the host. If the result of
 noting a Valid Pinning Header is to disable pinning for the host (such as
 because the host set a max-age directive with a value of 0), UAs MUST
 allow this new  nformation to override any built-in pins. That is, a host
 must be able to un-pin itself even from built-in pins.

-- 
-------------------------+----------------------
 Reporter:  palmer@…     |      Owner:  palmer@…
     Type:  defect       |     Status:  new
 Priority:  major        |  Milestone:
Component:  key-pinning  |    Version:
 Severity:  -            |   Keywords:
-------------------------+----------------------

Ticket URL: <http://trac.tools.ietf.org/wg/websec/trac/ticket/55>
websec <http://tools.ietf.org/websec/>

---

From: "websec issue tracker" <[email-masked]>
Date: Fri, 19 Oct 2012 21:33:09 -0000

Changes (by palmer@…):

 * status:  new => assigned

-- 
-------------------------+-----------------------
 Reporter:  palmer@…     |       Owner:  palmer@…
     Type:  defect       |      Status:  assigned
 Priority:  major        |   Milestone:
Component:  key-pinning  |     Version:
 Severity:  -            |  Resolution:
 Keywords:               |
-------------------------+-----------------------

Ticket URL: <http://trac.tools.ietf.org/wg/websec/trac/ticket/55#comment:1>
websec <http://tools.ietf.org/websec/>

---

From: Chris Palmer <[email-masked]>
Date: Fri, 19 Oct 2012 14:47:49 -0700

Any thoughts on this text?