Re: [OAUTH-WG] Auth Code Swap Attack

[Barry Leiba <[e-mail]>]

> I do not plan to publish another draft until this issue is closed and resolved.
> I plan to seek WG consensus to every change made to -21 prior to publication
> to reduce the need for another WG draft.
...
> and I informed the list of my intention of using the edited text. Mr. Nadalin then
> raised his disagreement with the proposed edit. Fine. Now we wait for more
> participants to express their views.

OK, this is where the disconnect came from, and why I had a problem
with what I heard.  My guess is that that's the same problem Tony had:
My interpretation of your one-line message that said, "I'm using my
proposed text in -21," was that you were deciding the issue, and were
about to publish a new draft now-ish that reflects your decision.
What you say here makes it clear that that's not the case, and that
what you meant was, "I believe my proposed text addresses this issue
while maintaining established consensus about the protocol details,
and when I post -21 (soon, but not now), which I hope will be the
final version, I intend to use that version of the text, unless
further discussion shows that WG consensus on the 'state' option has
now changed."

That's rather more long-winded, of course, but I have, as chair, no
problem at all with that plan.  I also suspect that Tony will consider
the longer-winded explanation to be less dismissive of the T/Y/T/P
proposal than the one-sentence version may have come across.

And, so, carry on.

Barry, still chair-like