Re: [Vcon] HTTPS only for externally referenced files

Thank you Laura, and welcome.  And that's a great question.  I'm pretty new here myself, and here's how I understand it. BTW, for me at least, RFC 3935 ( https://datatracker.ietf.org/doc/rfc3935/ ) "A Mission Statement for the IETF" is invaluable.

The killer paragraph that I think addresses this is:

  Quality: In this context, the ability to express ideas with enough
     clarity that they can be understood in the same way by all people
     building systems to conform to them, and the ability (and
     willingness) to describe the properties of the system well enough
     to understand important consequences of its design, and to ensure
     that those consequences are beneficial to the Internet as a whole.
     It also means that the specifications are designed with adherence
     to sound network engineering principles, so that use for its
     intended purpose is likely to be effective and not harmful to the
     Internet as a whole.
Second place:

Standard: As used here, the term describes a specification of a
     protocol, system behaviour or procedure that has a unique
     identifier, and where the IETF has agreed that "if you want to do
     this thing, this is the description of how to do it".  It does not
     imply any attempt by the IETF to mandate its use, or any attempt
     to police its usage - only that "if you say that you are doing
     this according to this standard, do it this way".  The benefit of
     a standard to the Internet is in interoperability - that multiple
     products implementing a standard are able to work together in
     order to deliver valuable functions to the Internet's users.

Thus, the choice of HTTPS is an accelerant to quality, and therefore supportive of making the Internet work better.  Secondly, the simpler the standard, the faster the interoperability. As a practical matter, we are suggesting the simplest, basest case for vCons for this work group.

That said, there are no protocol police.  I've looked.

=====================
Thomas Howe ( http://www.lightandelectric.com )
+1 (508) 364-9972

Sent via Superhuman ( https://sprh.mn/?vip=ghostofbasho@gmail.com )

On Wed, Apr 17, 2024 at 2:54 AM, Laura Orvokki Kursula < lav=40vampires.gay@dmarc.ietf.org > wrote:

> 
> 
> 
> Good day everyone,
> 
> 
> 
> I recently came upon this project by chance, and I find it really
> interesting! Reading the draft, it caught my attention that it requires
> the use of HTTPS for externally referenced files for confidentiality
> reasons (as a MUST in section
> 2.4.1 and as a SHOULD in section 5). I'm wondering whether there is a
> specific reason to require HTTPS over other secure means of transfering
> files -- I could imagine that another protocol could be more expedient for
> some users. What do others on this list think about this? I hope I am
> doing this correctly, since I am new to IETF things.
> 
> 
> 
> Kindest regards,
> Laura Orvokki Kursula
> 
> 
> 
> --
> 
> 
> 
> vCard:
> https://vampires.gay/laura.vcf
> 
> 
> 
> PGP:
> https://vampires.gay/keys/laura.asc
> 6710 55FA EFAB B442 44C4 F96F 3537 89E9 466D 09A8
> 
> 
> 
> --
> Vcon mailing list
> Vcon@ ietf. org ( Vcon@ietf.org )
> https:/ / www. ietf. org/ mailman/ listinfo/ vcon (
> https://www.ietf.org/mailman/listinfo/vcon )
> 
> 
>