Re: [websec] Issue 54 - Adding a report-only mode

Tom Ritter <tom@ritter.vg> Wed, 06 March 2013 02:55 UTC

MIME-Version: 1.0
In-Reply-To: <0e3af2fc9efa802944efa946a800b62b.squirrel@webmail.dreamhost.com>
References: <0e3af2fc9efa802944efa946a800b62b.squirrel@webmail.dreamhost.com>
From: Tom Ritter <tom@ritter.vg>
Date: Tue, 05 Mar 2013 21:55:06 -0500
Message-ID: <CA+cU71kfaJW72=5WST5T1t=GX1JKydAQ54hUxZz80B3Hqds=6w@mail.gmail.com>
To: ryan-ietfhasmat@sleevi.com
Content-Type: text/plain; charset="ISO-8859-1"
Cc: websec@ietf.org
Subject: Re: [websec] Issue 54 - Adding a report-only mode
Precedence: list

On 4 March 2013 20:09, Ryan Sleevi <ryan-ietfhasmat@sleevi.com> wrote:
> I'd like to solicit feedback and make sure that both the discussions from
> Atlanta and from the list have been accurately captured. Are there
> concerns with a Report-Only mode that have not been accurately captured?

Obviously I wasn't in Atlanta, but I feel if you're sending the known
pins in the report (and you should) you should send the whole policy
as you know it, including directives, and some mechanism for max-age
that says 'when I think this will expire'.  Maybe even 'when I got
this directive' (if available) and 'where i got this directive from'
(preloaded vs header).

port should be an integer or a string, but one or the other. Why have
it be ambiguous?

-tom

[websec] Issue 54 - Adding a report-only mode Ryan Sleevi
Re: [websec] Issue 54 - Adding a report-only mode Tom Ritter