Re: [websec] of quoted-string header field param value syntax (was: Strict-Transport-Security syntax redux)

[Adam Barth <[e-mail]>]

On Sun, Jan 15, 2012 at 2:27 PM, Julian Reschke <[e-mail]> wrote:
> On 2012-01-15 23:24, Adam Barth wrote:
>>
>> On Sun, Jan 15, 2012 at 2:11 PM, Julian Reschke<[e-mail]>
>>  wrote:
>>>
>>> On 2012-01-15 22:53, Adam Barth wrote:
>>>>
>>>> ...
>>>>
>>>> It's definitely messy.
>>>>
>>>> I don't think it matters much what we write in this document.  Even if
>>>> we spec quoted-string, I doubt many folks will implement it.  However,
>>>> we can deal with that problem when it comes time to add extension
>>>> values that actually used quoted-string.
>>>> ...
>>>
>>>
>>> Apologies for the direct question: just 14 days ago you stated that you
>>> did
>>> not implement q-s in Chrome, and that you don't intend to:
>>>
>>> AB>  Chrome does not (and will not) implement quoted-string for the STS
>>> AB>  header for the reasons I've explained previously.  You're welcome to
>>> AB>  file bugs, but I'm just going to close them WONTFIX.
>>>
>>> That's somewhat different from what you say now.
>>>
>>> Is "the extensions do not exist yet" the excuse for not implementing what
>>> the spec says? Will you be around for fixing Chrome when the first bug
>>> reports because of broken extensions come in?
>>
>> I don't plan to implement quoted-string in Chrome.  I'm saying that
>> I'm not going to object to writing quoted-string into the spec.  I
>> still think it's a bad idea, but I'm dropping my objection to it.
>
> So when the bug reports come in, *somebody else* is going to fix Chrome?
>
> I really want to know.

I doubt it will be high on anyone's priority list.  If you'd like to
implement it, you're welcome to submit a patch.  (Of course, I can't
promise that the patch will be accepted.)

Adam