Re: [http-auth] Ben Campbell's No Objection on draft-ietf-httpauth-scram-auth-15: (with COMMENT)

"Roy T. Fielding" <fielding@gbiv.com> Thu, 17 December 2015 00:20 UTC

Content-Type: text/plain; charset="us-ascii"
Mime-Version: 1.0 (Mac OS X Mail 8.2 \(2104\))
From: "Roy T. Fielding" <fielding@gbiv.com>
In-Reply-To: <5671FA70.6090303@cs.tcd.ie>
Date: Wed, 16 Dec 2015 16:20:33 -0800
Content-Transfer-Encoding: quoted-printable
Message-Id: <7CC7AC02-1898-41B3-A119-6B4707389B8D@gbiv.com>
References: <20151216235259.23225.93879.idtracker@ietfa.amsl.com> <5671FA70.6090303@cs.tcd.ie>
To: Stephen Farrell <stephen.farrell@cs.tcd.ie>
Archived-At: <http://mailarchive.ietf.org/arch/msg/http-auth/gpNmV1_l2hO9Zn8U2Zv4QzzdPYY>
Cc: Ben Campbell <ben@nostrum.com>, draft-ietf-httpauth-scram-auth@ietf.org, httpauth-chairs@tools.ietf.org, httpauth-chairs@ietf.org, http-auth@ietf.org, The IESG <iesg@ietf.org>, draft-ietf-httpauth-scram-auth-all@tools.ietf.org
Subject: Re: [http-auth] Ben Campbell's No Objection on draft-ietf-httpauth-scram-auth-15: (with COMMENT)
Precedence: list

> On Dec 16, 2015, at 3:57 PM, Stephen Farrell <stephen.farrell@cs.tcd.ie> wrote:
> On 16/12/15 23:52, Ben Campbell wrote:
>> Ben Campbell has entered the following ballot position for
>> draft-ietf-httpauth-scram-auth-15: No Objection
>> 
>> When responding, please keep the subject line intact and reply to all
>> email addresses included in the To and CC lines. (Feel free to cut this
>> introductory paragraph, however.)
>> 
>> 
>> Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
>> for more information about IESG DISCUSS and COMMENT positions.
>> 
>> 
>> The document, along with other ballot positions, can be found here:
>> https://datatracker.ietf.org/doc/draft-ietf-httpauth-scram-auth/
>> 
>> 
>> 
>> ----------------------------------------------------------------------
>> COMMENT:
>> ----------------------------------------------------------------------
>> 
>> Can you say something about why this is experimental? That is, what is
>> the nature of the experiment? Will results be reported? Is there a need
>> for deployment experience? Do you expect this to progress to standards
>> track at some point in the future?
> 
> See the charter of the http-auth wg. [1] All of the RFCs
> from this WG are experimental for the same reason, which
> is basically that browsers today don't want new HTTP
> authentication schemes (they probably don't want the old
> ones too;-)
> 
> S.
> 
> [1] https://tools.ietf.org/wg/httpauth/charters

I realize that was written into the charter (to satisfy someone's personal opinion),
but it isn't even remotely true that browsers aren't interested in new authentication
schemes on the standards track, and even if it were true it wouldn't matter: browsers
make up less than 1% of HTTP implementations.  The whole point of having extensible
authentication schemes is to allow them to be defined and developed independently of
"current practice".  And the point of having an initial standards track of Proposed
is to make clear they are proposals that are not necessarily deployed.

More useless procedural pain for no gain.

....Roy

[http-auth] Ben Campbell's No Objection on draft-… Ben Campbell
Re: [http-auth] Ben Campbell's No Objection on dr… Stephen Farrell
Re: [http-auth] Ben Campbell's No Objection on dr… Ben Campbell
Re: [http-auth] Ben Campbell's No Objection on dr… Roy T. Fielding
Re: [http-auth] Ben Campbell's No Objection on dr… Stephen Farrell