Content-Type: text/plain; charset=us-ascii
Mime-Version: 1.0 (Mac OS X Mail 6.0 \(1485\))
Subject: Re: [Gen-art] Gen-ART LC Review of
 draft-ietf-websec-strict-transport-sec-11
From: Ben Campbell <ben@estacado.net>
In-Reply-To: <50257E43.8010005@KingsMountain.com>
Date: Fri, 10 Aug 2012 16:55:47 -0500
Content-Transfer-Encoding: quoted-printable
Message-Id: <570BD336-2C91-4C7E-AC03-9FD5423AEB35@estacado.net>
References: <50257E43.8010005@KingsMountain.com>
To: =JeffH <Jeff.Hodges@kingsmountain.com>
Cc: Ben Campbell <ben@nostrum.com>, IETF Discussion List <ietf@ietf.org>,
 General Area Review Team <gen-art@ietf.org>, IETF WebSec WG <websec@ietf.org>,
 Alexey Melnikov <alexey.melnikov@isode.com>,
 draft-ietf-websec-strict-transport-sec.all@tools.ietf.org
Precedence: list

On Aug 10, 2012, at 4:33 PM, =3DJeffH <Jeff.Hodges@kingsmountain.com> =
wrote:

> Thanks Ben.
>=20
> > Jeff and I had a f2f discussion about this point in Vancouver. To =
paraphrase
> > (and I assume he will correct me if if I mischaracterize anything), =
Jeff
> > indicated that this really wasn't a MUST level requirement due to =
the
> > variation and vagaries in application behavior and abilities.
>=20
> Yes, see the NOTE in section 7.2.
>=20
> > Rather, it's
> > more of a "do the best you can" sort of thing. Specifically, he =
indicated
> > that an implementation that chose to go ahead and serve unprotected =
content
> > due to the listed caveats on redirecting to HTTPS would necessarily =
be
> > out-of-compliance.
>=20
> I presume you actually mean "not necessarily", which would then be =
correct, unless I'm misunderstanding something.

Oops, you are correct, that's a typo.

>=20
>=20
> > If the requirement really that you SHOULD NOT (rather than MUST NOT) =
serve
> > unprotected content, then I think the original language is okay.
>=20
> agreed.
>=20
> thanks,
>=20
> =3DJeffH
>=20
>=20
> _______________________________________________
> Gen-art mailing list
> Gen-art@ietf.org
> https://www.ietf.org/mailman/listinfo/gen-art