Re: [OAUTH-WG] why are we signing?

[Peter Saint-Andre <[e-mail]>]

<hat type='chair'/>

On 12/2/09 2:48 AM, Stephen Farrell wrote:
> I think we'll need an analysis of where we end up wanting TLS
> for the protocols we produce. I wouldn't expect any big
> surprises, but right now I don't think we can be sure since
> things seems to be in flux to some extent.
> 
> Then, I'd be for saying that TLS MUST be used for those operations.
> However, I can well believe that there may be some niches where
> using TLS isn't easy, so I could live with something like: it MUST
> be possible to use TLS, and that deployments SHOULD use it, with
> guidance as to the type of scenario where we think TLS really
> has to be turned on, and maybe text about why sometimes people
> can't do that.
> 
> So I don't think we can finish this discussion at this stage.

I think we can:

1. Software MUST implement TLS
2. Services should deploy TLS

Traditionally, RFCs enforce conformance requirements only on software
implementations, not on service deployments. And here there seems to be
enough variation in deployment land that "should deploy" is as far as we
can go.

Peter

-- 
Peter Saint-Andre
https://stpeter.im/