[Cbor] "<other-binary-format> should just die" (was Re: draft-edn-for-tls (was: Rebooting the naming discussion))

[Rohan Mahy <[e-mail]>]

I want to address this attitude directly, because I think it is hampering
our work.

On Sat, May 9, 2026 at 1:12 AM Vadim Goncharov <[e-mail]>
wrote:

> In fact TLS should just die,


Vadim, I'm not sure why you hate this encoding/protocol so much that
you use everyday.  I will point out that TLS was almost certainly used
several times to send your email, while likely no CBOR was used in the
process. Anyone care to hazard a guess how many orders of magnitude more
TLS-encoded data items traverse the Internet daily than CBOR-encoded ones?

When the opportunity to define a new protocol comes around, if we want CBOR
to be considered for its encoding, then we better be prepared to take the
requirements of those otherr protocols seriously. This often includes
robust tooling in common languages with strict validation support, the
ability to specify exactly a single canonical way of sending data, and a
way to signal which extensions are mandatory to understand.

If the only model we are willing to consider is bazaar-style extensibility
and we intentionally add features which are inconvenient or complex for
many implementers; we allow encoding variants that can be manipulated
easily by attackers; or we require either large amounts of state, large
buffers, or multiple passes to process, then the CBOR ecosystem is
automatically going to be out of the running.

Thanks,
-rohan


> together with all ASN.1 and X.509, but the latter
> will live longer, even in CBOR-based alternative... Still to be considered
> as
> legacy, hope we will be still alive when it's phased out..