Re: [http-auth] Ben Campbell's No Objection on draft-ietf-httpauth-scram-auth-15: (with COMMENT)

[Stephen Farrell <[e-mail]>]

On 17/12/15 00:20, Roy T. Fielding wrote:
> I realize that was written into the charter (to satisfy someone's personal opinion),
> but it isn't even remotely true that browsers aren't interested in new authentication
> schemes on the standards track, 

I said HTTP authentication schemes. I have seen zero evidence that
browsers are interested in those. I'd be happy if they were. Can
you point at some?

> and even if it were true it wouldn't matter: browsers
> make up less than 1% of HTTP implementations.  

Hmm. I don't at all agree that it doesn't matter if browser makers
do or do not want to adopt some technology. But that they don't like
something is not a sufficient reason to not do that thing, I hope
we do agree about that.

> The whole point of having extensible
> authentication schemes is to allow them to be defined and developed independently of
> "current practice".  

I agree that defining things that are better than basic and digest
is worthwhile. (Hence my working on RFC 7486 and an implementation
thereof.)

> And the point of having an initial standards track of Proposed
> is to make clear they are proposals that are not necessarily deployed.
> 
> More useless procedural pain for no gain.

What pain? Experimental vs. PS makes no real procedural difference to
the authors. Except it maybe gets some folks off their backs in a case
like this.

S.