Re: [websec] Strict-Transport-Security syntax redux

[Adam Barth <[e-mail]>]

It seems we're not in agreement.  We can repeat the same arguments
over and over again, but it's not clear that would be productive.

Adam


On Fri, Dec 30, 2011 at 2:00 AM, Julian Reschke <[e-mail]> wrote:
> On 2011-12-30 10:13, Adam Barth wrote:
>>
>> Using quoted-string in the extension directive is the wrong thing to
>> do.  Because none of the actual directives use quoted-string, folks
>> are likely to write parsers that don't handle all the complexities of
>> quoted-string (which are legion).  That means when we go to actually
>> use quoted-string in a future directive, it won't actually work in
>> many user agents.
>
>
> Unless we clarify the syntax, allow q-s everywhere, and have test cases.
>
>
>> On the other hand, if we spec the extension directives without
>> quoted-string, future extensions will work even if folks mistakenly
>> implement quote-string (because DQUOTE is forbidden in the extension
>> syntax I suggested above, so we'll never trigger the mistaken
>> quoted-string parsing code).  Everyone lives a happy life.
>
>
> Absolutely not.
>
> First of all, some implementations will parse q-s, because that's consistent
> with other header fields. Also, not having q-s makes certain values
> impossible to send, in which case you'll need to invent yet another escaping
> syntax.
>
>
>> Anyway, it's all somewhat of a moot point because the above will
>> happen regardless of what we write in the spec.  Even if we write
>> quoted-string, when folks attempt to use these extension directives in
>> the future, they'll find that they don't work and they'll update the
>> syntax not to use quoted-string.
>
>
> Why would they find that? Implementations can be fixed.
>
> Or is this argument based on the fact that you *currently* "own" one
> implementation and claim it can't be fixed? That would be a very strange
> thing to do in the context of an IETF WG trying to reach consensus.
>
> Best regards, Julian
>
> PS: I note that we are in violent agreement that the syntax should be the
> same for all directives, predefined or extension. We just come to different
> conclusions about what that syntax should be.