Re: Review of draft-ietf-httpbis-http2-encryption-10

Mark Nottingham <mnot@mnot.net> Mon, 27 February 2017 01:25 UTC

Resent-Date: Mon, 27 Feb 2017 01:23:20 +0000
Resent-Message-Id: <E1ciA24-0007Bh-IR@frink.w3.org>
Content-Type: text/plain; charset="us-ascii"
Mime-Version: 1.0 (Mac OS X Mail 10.2 \(3259\))
From: Mark Nottingham <mnot@mnot.net>
In-Reply-To: <148807201447.969.8886471079003742158.idtracker@ietfa.amsl.com>
Date: Mon, 27 Feb 2017 12:22:34 +1100
Cc: gen-art@ietf.org, HTTP Working Group <ietf-http-wg@w3.org>
Content-Transfer-Encoding: quoted-printable
Message-Id: <DD581639-035F-4C57-9DBC-9254658374D1@mnot.net>
References: <148807201447.969.8886471079003742158.idtracker@ietfa.amsl.com>
To: Brian Carpenter <brian.e.carpenter@gmail.com>
Received-SPF: pass client-ip=216.86.168.182; envelope-from=mnot@mnot.net; helo=mxout-07.mxes.net
Subject: Re: Review of draft-ietf-httpbis-http2-encryption-10
Archived-At: <http://www.w3.org/mid/DD581639-035F-4C57-9DBC-9254658374D1@mnot.net>
Resent-From: ietf-http-wg@w3.org
Resent-Sender: ietf-http-wg-request@w3.org
Precedence: list

[ editor hat ]

That all seems reasonable to me; see:

  https://github.com/httpwg/http-extensions/commit/ca56fd8365
  https://github.com/httpwg/http-extensions/commit/31c11b4683

Will incorporate into the next draft when we issue.

Thanks!


> On 26 Feb 2017, at 12:20 pm, Brian Carpenter <brian.e.carpenter@gmail.com> wrote:
> 
> Reviewer: Brian Carpenter
> Review result: Ready with Issues
> 
> Gen-ART Last Call review of draft-ietf-httpbis-http2-encryption-10
> 
> I am the assigned Gen-ART reviewer for this draft. The General Area
> Review Team (Gen-ART) reviews all IETF documents being processed
> by the IESG for the IETF Chair.  Please treat these comments just
> like any other last call comments.
> 
> For more information, please see the FAQ at
> <http://wiki.tools.ietf.org/area/gen/trac/wiki/GenArtfaq>.
> 
> Document: draft-ietf-httpbis-http2-encryption-10.txt
> Reviewer: Brian Carpenter
> Review Date: 2017-02-26
> IETF LC End Date: 2017-03-06
> IESG Telechat date: 2017-03-16 
> 
> Summary: Ready with issues
> --------
> 
> Comments:
> ---------
> 
> Note: Category is Experimental.
> 
> Quoting the writeup:
> 
> 'The primary concern voiced by dissenters has been that widespread
> deployment might provide a false sense of security, slowing the
> adoption of "real" HTTPS or confusing users."'
> 
> FWIW, I share that concern, even with the tag 'Experimental.'
> 
> Major issue: 
> ------------
> 
> The Abstract should definitely state the above concern. At the
> moment,
> it could easily mislead the reader about the value of the solution.
> I'd like to see the phrase "it is vulnerable to active attacks" in
> the Abstract.
> 
> Minor issue:
> ------------
> 
>> 4.4.  Confusion Regarding Request Scheme
> ...
>> Therefore, servers need to carefully examine the use of such
> signals
>> before deploying this specification.
> 
> What does "servers" really mean here? I think it means "implementers
> of server code", or maybe "operators of servers"?
> 
> Nits:
> -----
> 
>> 4.1.  Security Indicators
>> 
>>  User Agents MUST NOT provide any special security indicia when an
> 
> 'Indicia' is a real word, but I think it's unknown to at least 99% of
> English speakers. Why not 'indicators' again?
> 
> 
> 
> 

--
Mark Nottingham   https://www.mnot.net/

Re: Review of draft-ietf-httpbis-http2-encryption… Mark Nottingham