Re: [http-state] Minor things concerning draft-ietf-httpstate-cookie-01

[Adam Barth <[e-mail]>]

On Tue, Jan 12, 2010 at 2:54 AM, Georg Koppen <[e-mail]> wrote:
>>> 5) Section 5 says that there are some algorithms specified for some
>>> tasks concerning the cookie protocol but the user agents do not have to
>>> follow these ("user agents are free to implement the cookie
>>> protocol..."). But, for instance in Section 5.1.1., there it says "The
>>> user agent MUST use the following algorithm..." Thus, am I free to
>>> implement it differently or not? It's a bit confusing...
>>
>> The operative requirement is:
>>
>>       <t>Although some parts of the cookie protocol are specified
>>       algorithmically, user agents are free to implement the cookie protocol
>>       in any manner as long as their resultant behavior is "black-box"
>>       indistinguishable from a user agent that implements the protocol as
>>       described.</t>
>>
>> Is there some way we can be clearer that user agents are free to
>> implement the protocol however they like?
>
> Why MUST the user use these algorithms? Wouldn't it be enough if the
> user MAY use them? I mean, they are free to implement the protocol
> however they want to do it, provided they come to the same results.

The goal is to require that they come up with the same results.  I
guess we could say something more elaborate each time.  It just seems
a bit wordy.  Any suggestions for text to use?

Adam