Re: [apps-discuss] Kathleen Moriarty's Discuss on draft-ietf-appsawg-json-merge-patch-06: (with DISCUSS)

On Aug 20, 2014 6:50 PM, "Paul Hoffman" <paul.hoffman@vpnc.org> wrote:
>
[Snip]
>
> I'm not sure I can add those sentences in a useful fashion. With current
delivery mechanisms (HTTP being the most common), MIME objects don't come
with hashes for checking. So giving that advice would cause developers to
look for something that they won't have, namely hashes of the MIME object
they just got.
>

+1

> I do hope you're not asking us to change the format to include an
internal hash. That would require inventing JSON canonicalization (which
the JOSE WG has flailed miserably on) and say "canonicalize, pick a hash
function, hash, and add that to the patch object". The recipient would need
to pull the hash out before processing the patch, canonicalize the result,
and check the hash. This is conceptually possible but it seems onerous, and
has not been done in any of the earlier patch formats that have been
standardized in the IETF.
>

+1... Adding an internal hash would not work with this mechanism without
taking a major step backwards. I do not see the value.

- James

> --Paul Hoffman
> _______________________________________________
> apps-discuss mailing list
> apps-discuss@ietf.org
> https://www.ietf.org/mailman/listinfo/apps-discuss