[websec] #41: add parameter indicating whether to hardfail or not

["websec issue tracker" <[e-mail]>]

#41: add parameter indicating whether to hardfail or not

 https://www.ietf.org/mail-archive/web/websec/current/msg01093.html - yoav
 nir

 The significant:

 I have said this before, and was rejected by the group, so I'll raise this
 one last time here.
 Section 8.3 makes it a MUST-level requirement that any failure of the
 underlying secure transport. Section 11.1 clarifies that there should be
 no user recourse for this. This makes the cost of implementing
 unreasonably high, and significantly discourages trial roll-outs. Adding
 an HSTS header to your web site takes about 2 lines of configuration file
 in Apache. But doing so makes small errors like letting the certificate
 lapse or using links with a different FQDN cause hard failures. Both these
 sections do now state specifically what constitutes a failure, so it might
 be that the intention was not to include expirations. I think this should
 be clarified, but mismatched names obviously apply.
 I suggest that either we remove the no user recourse advice, or else add a
 "hardfail" directive. Roll out with "hardfail=no", and if people don't
 complain, change to "hardfail=yes"

-- 
-------------------------+-------------------------------------------------
 Reporter:               |      Owner:  draft-ietf-websec-strict-transport-
  jeff.hodges@…          |  sec@…
     Type:  enhancement  |     Status:  new
 Priority:  major        |  Milestone:
Component:  strict-      |    Version:
  transport-sec          |   Keywords:
 Severity:  In WG Last   |
  Call                   |
-------------------------+-------------------------------------------------

Ticket URL: <http://trac.tools.ietf.org/wg/websec/trac/ticket/41>
websec <http://tools.ietf.org/websec/>