Subject: [apps-discuss] Comment on draft-thomson-http-omnomnom-00

From: Cullen Jennings <[email-masked]>
Date: Sat, 23 Jul 2016 03:37:30 -0600

So the relevant text of this draft is 

   Cookies that are set using insecure channels (i.e., HTTP over
   cleartext TCP), MUST have a short time limit on the time that they
   are persisted.

Without specifying what a short time is, this seems like a pretty vacuous MUST. Perhaps an exact value could be provided.

---

From: Martin Thomson <[email-masked]>
Date: Sat, 23 Jul 2016 14:28:47 +0200

I agree.  The point of the draft was to facilitate a discussion about
times and what conditions might be applied to those times (a single
value might be difficult to pick across all situations).