Re: [Json] secdir review of draft-ietf-jsonbis-rfc7159bis-03 [rfc7159bis scope]

[Julian Reschke <[e-mail]>]

On 2017-03-16 21:25, Matthew A. Miller wrote:
> ...
> That said, I'm not quite sure about going that far.  The web certainly
> uses UTF-8 and no other, but the scope is greater than that.  I would
> suggest keeping much of Peter's original text, with a small change to
> include the prohibition of encodings outside of UTF-8/-16/-32[1]:
>
>    JSON text SHOULD be encoded in UTF-8 [UNICODE] (Section 3), and MAY
>    be encoded in UTF-16 or UTF-32.  JSON texts that are encoded in UTF-8
>    are interoperable in the sense that they will be read successfully by
>    the maximum number of implementations.

That's a normative change from RFC 7159, which, as you clarified below 
(thanks!), has a MUST-level requirement to use UTF-8/16/32.

So this change actually allows other encodings (SHOULD != SHALL or MUST) 
without actually specifying how to interop with these (lacking an 
encoding declaration).

So I'd say that's a non-starter.

>    There are many implementations that cannot successfully read texts
>    in other encodings.  JSON text MAY be encoded in other encodings if
>    the generator is sure that the intended parsers can read them.

We can't prevent people from doing this, but, FWIW, it shouldn't be ok 
to label these payloads "application/json".

Best regards, Julian