Re: [Json] secdir review of draft-ietf-jsonbis-rfc7159bis-03 [rfc7159bis scope]

["Matthew A. Miller" <[e-mail]>]

On 17/03/16 14:39, Julian Reschke wrote:
> On 2017-03-16 21:25, Matthew A. Miller wrote:
>> ...
>> That said, I'm not quite sure about going that far.  The web certainly
>> uses UTF-8 and no other, but the scope is greater than that.  I would
>> suggest keeping much of Peter's original text, with a small change to
>> include the prohibition of encodings outside of UTF-8/-16/-32[1]:
>>
>>    JSON text SHOULD be encoded in UTF-8 [UNICODE] (Section 3), and MAY
>>    be encoded in UTF-16 or UTF-32.  JSON texts that are encoded in UTF-8
>>    are interoperable in the sense that they will be read successfully by
>>    the maximum number of implementations.
> 
> That's a normative change from RFC 7159, which, as you clarified below
> (thanks!), has a MUST-level requirement to use UTF-8/16/32.
> 
> So this change actually allows other encodings (SHOULD != SHALL or MUST)
> without actually specifying how to interop with these (lacking an
> encoding declaration).
> 
> So I'd say that's a non-starter.
> 
>>    There are many implementations that cannot successfully read texts
>>    in other encodings.  JSON text MAY be encoded in other encodings if
>>    the generator is sure that the intended parsers can read them.
> 
> We can't prevent people from doing this, but, FWIW, it shouldn't be ok
> to label these payloads "application/json".
> 
> Best regards, Julian
> 

[ /me continues with no hat ]

Then we're still at an impasse as far as multiple encodings go.  As I
personally see it, the only choices are:

1. Section 8.1 stays exactly as it is; or
2. Make the (normative) change to restrict the encoding to UTF-8 only.


- m&m

Matthew A. Miller