[httpapi] Re: AD Review of draft-ietf-httpapi-api-catalog-03

["Salz, Rich" <[e-mail]>]

Speaking as a Chair, trying to bring in some other experience.

In the security world, at least, we have the concept of “mandatory to implement” (MTI). It’s typically one, sometimes two, algorithms that must be implemented by every implementation of an RFC. This allows clients and servers to spring up and interoperate without prior out-of-band communication.  (In-band it’s typically called negotiation, and while a real-time communication protocol like TLS support it, a static data format like cryptographically-encoded messages (CMS) can’t: the best they can do is unambiguously identify what they are using.)

HTTP is not unlike TLS, in that content negotiation allows choices to be made. But without an MTI to fall back on, the transaction could still fail because they don’t have a common message format (or algorithm).

This might be something the WG wants to keep in mind while discussing this. Recall the people who asked for an MTI – among others, Mark N and our AD – and see if we really want to not agree with their suggestions.