Re: [Unbearable] WGLC 3 on core documents

[Brian Campbell <[e-mail]>]

On Wed, Mar 1, 2017 at 4:43 PM, Martin Thomson <[e-mail]>
wrote:

> On 2 March 2017 at 08:21, Brian Campbell <[e-mail]>
> wrote:
> >> I believe there was some opposition to MUST, for deployments where the
> >> client has knowledge of the cooperating servers. If nobody opposes a
> switch
> >> to MUST, I think it may be a good change to make.
> >
> >
> > Yes there's a desire for the allowance of different scoping rules for
> > application protocols where there's already knowledge of the cooperating
> > servers and/or correlatable info is already being sent in a token to
> > different servers.
>
> That's not an argument for SHOULD, that's an argument for flexibility
> in scoping rules, which you already have.  Since the application
> protocol determines the scoping rules, you can let the MUST stand and
> define scoping rules for the application protocol that suit your
> needs.
>


Yes it's an argument for flexibility. My concern is with how the text might
be interrupted. With the SHOULD to MUST change you're suggesting, it would
say,

 "In order to prevent cooperating
   servers from linking user identities, different keys MUST be used
   by the client for connections to different servers, according to the
   token scoping rules of the application protocol."

And I worry that some will zero in on the "different keys MUST be used by
the client for connections to different servers" and take it very literally
(especially the "to different servers" part) and out of context of the rest
of the sentence that qualifies it with respect to the application protocol
token scoping rules. Maybe that worry is unfounded but having it be SHOULD
felt like it helps give that flexibility.

I take your point though.

What if it just said,

 "In order to prevent cooperating
   servers from linking user identities, different keys MUST be used
   by the client, according to the
   token scoping rules of the application protocol."

taking the "different servers" bit out?