Re: [apps-discuss] Webfinger

[Gonzalo Salgueiro <[e-mail]>]

On Nov 21, 2011, at 12:53 PM, Blaine Cook wrote:

> On 21 November 2011 15:49, Paul E. Jones <[e-mail]> wrote:
>> 1)      You want to mandate use of JSON, which we also indicated in the
>> draft.  However, I would personally prefer to give both XML and JSON equal
>> weight and require both.
> 
> Implementations of XML-based host-meta clients are significantly more
> complex than JSON implementations. To completely abandon XML-based
> host-meta would have been impossible, but JSON is vastly preferred. To
> lower the barrier for Webfinger adoption, +1 for JSON as a strong
> recommendation over XML. It's still early days, so existing
> implementations shouldn't be given undue weight.

I agree that XML should be retained, but JSON given preference.  This is a nice opportunity for a good old fashioned RFC 2119 'RECOMMENDED'.

--Gonzalo

> 
>> 2)      You wanted to mandate HTTPS. I’m not opposed, but host-meta does not
>> mandate it.  Shouldn’t we Webfinger requirements on what is there?
> 
> host-meta does not necessarily have security implications. Webfinger
> almost certainly does, and as such should mandate HTTPS.
> 
> b.
>