Re: [http-state] Ticket 6: host-only cookies

[Lisa Dusseault <[e-mail]>]

On Thu, Jan 28, 2010 at 2:12 PM, Roy T. Fielding <[e-mail]> wrote:

> This is an IETF spec, so it will obey IETF norms, and I can tell you
> that it won't pass IESG review with a non-secure alternative being
> allowed as part of the proposed standard.

IESG review has gotten more flexible in some ways in the four years
I've been on the IESG.  I would certainly expect a document to pass
IESG review (and if I saw any counter-arguments, would expect
excellent and well-informed arguments against the document) if
 - it clearly stated it was documenting existing behavior and
explained in descriptive terms how to interoperate with it
 - it stated that supporting the non-secure alternative in browsers
was NOT RECOMMENDED for best user experience
 - it stated that relying on the non-secure alternative in sites was
deprecated and NOT RECOMMENDED

I'm not saying that's the best approach for this particular issue, but
I'd rather debate what is the best approach for this particular issue
first, before worrying about what some future review group might or
might not do.

Lisa