Message-ID: <5024DC5E.60404@gondrom.org>
Date: Fri, 10 Aug 2012 11:03:10 +0100
From: Tobias Gondrom <tobias.gondrom@gondrom.org>
User-Agent: Mozilla/5.0 (X11; Linux x86_64;
 rv:14.0) Gecko/20120714 Thunderbird/14.0
MIME-Version: 1.0
To: alexey.melnikov@isode.com
Subject: Re: Gen-ART LC Review of draft-ietf-websec-strict-transport-sec-11
References: <50161BD5.7040901@KingsMountain.com>
 <344AB802-6D45-4399-A628-6852A4732C16@nostrum.com>
 <502441B7.8020001@isode.com>
In-Reply-To: <502441B7.8020001@isode.com>
Content-Type: multipart/alternative;
 boundary="------------080205060203060004010107"
Cc: ben@nostrum.com, ietf@ietf.org, gen-art@ietf.org, websec@ietf.org,
 draft-ietf-websec-strict-transport-sec.all@tools.ietf.org
Precedence: list

This is a multi-part message in MIME format.
--------------080205060203060004010107
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit

On 10/08/12 00:03, Alexey Melnikov wrote:
> On 02/08/2012 10:46, Ben Campbell wrote:
>> Hi, thanks for the response.  Comments inline:
>>
>> On Jul 29, 2012, at 10:29 PM, =JeffH <Jeff.Hodges@kingsmountain.com> 
>> wrote:
>  [...]
>>>> -- section 7.2:
>>>>
>>>> Am I correct to assume that the server must never just serve the 
>>>> content over
>>>> a non-secure connection? If so, it would be helpful to mention 
>>>> that, maybe
>>>> even normatively.
>>> It's a SHOULD, see the Note in that section, so it's already 
>>> effectively stated normatively, though one needs to understand HTTP 
>>> workings to realize it in the way you stated it above. Perhaps could 
>>> add a simple statement as you suggest to the intro para for section 
>>> 7 Server Processing Model, to address this concern?
>>>
>> I think something of the form SHOULD redirect to HTTPS, but MUST NOT 
>> under any circumstances send the content unprotected would improve 
>> the text.
>
> Sounds good to me. (And yes, this is implied, but it doesn't hurt to 
> state explicitly.)
>
>> That's probably already implied, and a reasonable implementor 
>> wouldn't due it anyway. But my experience is that some readers will 
>> find strange interpretations whenever you give them the wiggle room 
>> to do so, so it's better to be explicit.
>
>
<hat="individual">
Agree with Alexey and Ben. Tobias



--------------080205060203060004010107
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit

<html>
  <head>
    <meta content="text/html; charset=ISO-8859-1"
      http-equiv="Content-Type">
  </head>
  <body bgcolor="#FFFFFF" text="#000000">
    <div class="moz-cite-prefix">On 10/08/12 00:03, Alexey Melnikov
      wrote:<br>
    </div>
    <blockquote cite="mid:502441B7.8020001@isode.com" type="cite">On
      02/08/2012 10:46, Ben Campbell wrote:
      <br>
      <blockquote type="cite">Hi, thanks for the response.&nbsp; Comments
        inline:
        <br>
        <br>
        On Jul 29, 2012, at 10:29 PM, =JeffH
        <a class="moz-txt-link-rfc2396E" href="mailto:Jeff.Hodges@kingsmountain.com">&lt;Jeff.Hodges@kingsmountain.com&gt;</a> wrote:
        <br>
      </blockquote>
      &nbsp;[...]
      <br>
      <blockquote type="cite">
        <blockquote type="cite">
          <blockquote type="cite">-- section 7.2:
            <br>
            <br>
            Am I correct to assume that the server must never just serve
            the content over
            <br>
            a non-secure connection? If so, it would be helpful to
            mention that, maybe
            <br>
            even normatively.
            <br>
          </blockquote>
          It's a SHOULD, see the Note in that section, so it's already
          effectively stated normatively, though one needs to understand
          HTTP workings to realize it in the way you stated it above.&nbsp;
          Perhaps could add a simple statement as you suggest to the
          intro para for section 7 Server Processing Model, to address
          this concern?
          <br>
          <br>
        </blockquote>
        I think something of the form SHOULD redirect to HTTPS, but MUST
        NOT under any circumstances send the content unprotected would
        improve the text.
        <br>
      </blockquote>
      <br>
      Sounds good to me. (And yes, this is implied, but it doesn't hurt
      to state explicitly.)
      <br>
      <br>
      <blockquote type="cite">That's probably already implied, and a
        reasonable implementor wouldn't due it anyway. But my experience
        is that some readers will find strange interpretations whenever
        you give them the wiggle room to do so, so it's better to be
        explicit.
        <br>
      </blockquote>
      <br>
      <br>
    </blockquote>
    &lt;hat="individual"&gt;
    <br>
    <font face="Arial">Agree with Alexey and Ben. Tobias<br>
      <br>
    </font><br>
  </body>
</html>

--------------080205060203060004010107--