Re: [websec] of quoted-string header field param value syntax (was: Strict-Transport-Security syntax redux)

[Adam Barth <[e-mail]>]

On Sun, Jan 15, 2012 at 3:03 PM, Julian Reschke <[e-mail]> wrote:
> On 2012-01-15 23:55, Adam Barth wrote:
>> On Sun, Jan 15, 2012 at 2:27 PM, Julian Reschke<[e-mail]>
>>  wrote:
>>> On 2012-01-15 23:24, Adam Barth wrote:
>>>> On Sun, Jan 15, 2012 at 2:11 PM, Julian Reschke<[e-mail]>
>>>>  wrote:
>>>>> On 2012-01-15 22:53, Adam Barth wrote:
>>>>>> ...
>>>>>>
>>>>>> It's definitely messy.
>>>>>>
>>>>>> I don't think it matters much what we write in this document.  Even if
>>>>>> we spec quoted-string, I doubt many folks will implement it.  However,
>>>>>> we can deal with that problem when it comes time to add extension
>>>>>> values that actually used quoted-string.
>>>>>> ...
\>>>>>
>>>>> Apologies for the direct question: just 14 days ago you stated that you
>>>>> did
>>>>> not implement q-s in Chrome, and that you don't intend to:
>>>>>
>>>>> AB>    Chrome does not (and will not) implement quoted-string for the
>>>>> STS
>>>>> AB>    header for the reasons I've explained previously.  You're
>>>>> welcome to
>>>>> AB>    file bugs, but I'm just going to close them WONTFIX.
>>>>>
>>>>> That's somewhat different from what you say now.
>>>>>
>>>>> Is "the extensions do not exist yet" the excuse for not implementing
>>>>> what
>>>>> the spec says? Will you be around for fixing Chrome when the first bug
>>>>> reports because of broken extensions come in?
>>>>
>>>>
>>>> I don't plan to implement quoted-string in Chrome.  I'm saying that
>>>> I'm not going to object to writing quoted-string into the spec.  I
>>>> still think it's a bad idea, but I'm dropping my objection to it.
>>>
>>>
>>> So when the bug reports come in, *somebody else* is going to fix Chrome?
>>>
>>> I really want to know.
>>
>>
>> I doubt it will be high on anyone's priority list.  If you'd like to
>> implement it, you're welcome to submit a patch.  (Of course, I can't
>> promise that the patch will be accepted.)
>> ...
>
>
> 14 days ago you said:
>
>> Chrome does not (and will not) implement quoted-string for the STS
>> header for the reasons I've explained previously.  You're welcome to
>> file bugs, but I'm just going to close them WONTFIX.
>
> Has this changed? Will patches be closed as WONTFIX no matter how good they
> are?

I'll state my opinion about the patch, which hasn't changed.  However,
it's an open source project.  You're welcome to submit whatever
patches you like.  They'll get reviewed and discussed, just like any
other patches.

> It *really* would be helpful if you would clearly state your position. And
> also clarify on whose behalf you are speaking here.

Am I not being clear?  I'm not going to implemented quoted-string, and
I doubt that many other folks will either.  I'm no longer objecting to
including quoted-string in the spec (although I believe including it
is the wrong decision).

As is customary at the IETF, I speak for myself.

Adam