Re: [http-state] Whether to recommend the cookie protocol (was Re: I-D Action:draft-ietf-httpstate-cookie-04.txt)

[Maciej Stachowiak <[e-mail]>]

On Feb 23, 2010, at 6:55 PM, Adam Barth wrote:

> On Tue, Feb 23, 2010 at 9:10 AM, Anne van Kesteren  
> <[e-mail]> wrote:
>
>> There's no suitable replacement for cookies
>> available currently so giving this advice seems a bit premature,  
>> but maybe I
>> misunderstand what it says.
>
> Hopefully we'll create a suitable replacement in phase two.  If not,
> necessity is the mother of invention...

I look forward to the more exciting XHTML2 phase of our Working Group,  
but perhaps we should wait until we actually have a good replacement  
before we tell people to stop using what works today.

> On Tue, Feb 23, 2010 at 9:15 AM, Blake Frantz  
> <[e-mail]> wrote:
>> Similarly, the top of section '7.1 General Recommendations' states:
>>
>> "The cookie protocol is NOT RECOMMENDED for new applications".
>>
>> This statement may require the same clarification as the one noted  
>> by Anne.
>
> What clarification do you have in mind?  Keep in mind that we're
> writing this document for the long term.  Just because we don't have
> an alternative in mind doesn't mean we won't have better options in
> the future.
>
> Would you really recommend that new applications of HTTP use cookies?

Doesn't "NOT RECOMMENDED" effectively give a SHOULD-level requirement  
not to use any of the spec we are developing, and furthermore one that  
is likely to be almost totally ignored? That seems like two good  
reasons to omit that statement, at least if it is framed as a  
conformance statement.

Regards,
Maciej