Re: [http-auth] Pete Resnick's No Objection on draft-ietf-httpauth-basicauth-update-06: (with COMMENT)

[Barry Leiba <[e-mail]>]

A final note form me on this, and then I'm done with the discussion:

> The problem here is the "long tail". We simply have no information about
> whether these IDs exist in practice. The fact that all UAs I checked indeed
> accept them at least *hints* that they might be used somewhere. Or none of
> the implementers ever thought about rejecting them.

I don't think this matters (but see below).  From the point of view of
protocol definition, it doesn't matter what's done; it matters what
works.  If userids with colons don't work when you send them on the
wire (because servers don't interpret the userid/password field as
intended), then the protocol definition should ban them, even if user
agents are, in fact sending them on the wire and will continue to.

But...

> The discussion that we're having is whether "MUST NOT use colons" is better
> or worse than "colons are invalid". I don't believe it makes a difference.

I have to admit that I don't either, and that's why I'm done with this
discussion.  I don't think that changing "X is invalid" to "MUST NOT
X" is important enough that it's worth further discussion, and I'm
happy to have that left as it is.  We might consider slightly altering
the text to make it clear that what we say is being done in practice
often does not work and is not interoperable (rather than the sort of
vague "will likely treat in a way not intended" text that's there
now).  Meh.  I'll leave that up to Julian and Pete to discuss.

Julian, thanks for the discussion.

Barry