[http-auth] Pete Resnick's No Objection on draft-ietf-httpauth-basicauth-update-06: (with COMMENT)

["Pete Resnick" <[e-mail]>]

Pete Resnick has entered the following ballot position for
draft-ietf-httpauth-basicauth-update-06: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)


Please refer to http://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.


The document, along with other ballot positions, can be found here:
http://datatracker.ietf.org/doc/draft-ietf-httpauth-basicauth-update/



----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

2: I'd at least like to hear an explanation about why this is
unreasonable (if it is):

OLD
   Furthermore, a user-id containing a colon character is invalid, as
   recipients will split the user-pass at the first occurrence of a
   colon character.  Note that many user agents however will accept a
   colon in user-id, thereby producing a user-pass string that
   recipients will likely treat in a way not intended by the user.
NEW
   Furthermore, a user-id MUST NOT contain a colon character, as
   recipients will split the user-pass at the first occurrence of a
   colon character.  Many user agents will accept a colon in user-id,
   but this produces a user-pass string that recipients will likely
   treat in a way not intended by the user.
END

MUST NOT means that not using a colon is required for interoperation.
Which is true. So I don't see why you don't come out and say that.