Re: [OAUTH-WG] Basic signature support in the core specification

To be clear, I think signatures are important, and I think that standardizing them would be really useful. One of the early complaints about OAuth 1.0 was that the signature mechanism was different than the OpenID mechanism. Having a standard signature mechanism in this space seems like a good thing. Having a signature mechanism be an optional part of the OAuth spec makes them less appealing to others.

I also think that standard tokens are really useful, and that they would be useful in other places besides OAuth, which is why they are in a different spec.

On 2010-09-25, at 7:54 AM, Eran Hammer-Lahav wrote:

> My logic is that your suggested organization is based on your personal preferences and what you consider core. If I applied my personal preference, half of core would be elsewhere. My point is that deciding signatures is the part belonging elsewhere is completely subjective to how important one think it is.
> 
> EHL
> 
> 
> On 9/24/10 10:43 PM, "Dick Hardt" <dick.hardt@gmail.com> wrote:
> 
> I don't follow your logic ... or perhaps I don't see why the spec needs to be written in more than two parts.
> 
> For example, the current spec does not specify the format of the token -- which keeps it simpler and straight forward. There are separate draft specs for standardizing the token. Similarly, I think the spec could be written to not include signatures, and put signatures into a different, reusable spec. If you would like help with that organization, I'll volunteer. :)
> 
> -- Dick
> 
> On 2010-09-24, at 7:24 PM, Eran Hammer-Lahav wrote:
> 
> I’m happy to do that. But I will be breaking the spec into more than two parts. Basically, I will be creating a version that does not force anyone to read anything they might not care about. Clearly, we shouldn’t based editorial decisions on what you want to read :-)
> 
> EHL
> 
> 
> On 9/24/10 5:21 PM, "Dick Hardt" <dick.hardt@gmail.com <x-msg://14/dick.hardt@gmail.com> > wrote:
> 
> -1 in core
> 
> +1 to being referenced in core and being a separate document
> 
> On 2010-09-23, at 6:43 PM, Eran Hammer-Lahav wrote:
> 
> > Since much of this recent debate was done off list, I'd like to ask people
> > to simply express their support or objection to including a basic signature
> > feature in the core spec, in line with the 1.0a signature approach.
> >
> > This is not a vote, just taking the temperature of the group.
> >
> > EHL
> >
> > _______________________________________________
> > OAuth mailing list
> > OAuth@ietf.org <x-msg://14/OAuth@ietf.org> 
> > https://www.ietf.org/mailman/listinfo/oauth
> 
> 
> 
> 