From nobody Wed Feb 1 02:06:07 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -6.354 X-Spam-Level: X-Spam-Status: No, score=-6.354 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-1.156, RP_MATCHES_RCVD=-3.199, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=github.com; h=from:reply-to:to:cc:in-reply-to:references:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=hlFhko5G8p4aspk6VKhdD7PBltc=; b=cfCy6NtBr74Pku5K gjas8CN7DumCpyAFAfbzV2nALiV/IISLqC/RA5NZSaHlM2tO3VhtbF0JrevHvjDi Syv9gR4cwhXWP021c1doiCeJPiIHhwnT6ixfMQtQcibUc+eLc5IdbfvaycCQmKBQ OAa2pv+xuyAOBQ1dAAb8YIumcrw= Date: Wed, 01 Feb 2017 02:05:53 -0800 To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] DNS relaxation, smaller initial Origin Set (#285) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_5891b301eb45c_6dfb3ff6a5d5d1403551d0"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Feb 2017 10:06:05 -0000 ----==_mimepart_5891b301eb45c_6dfb3ff6a5d5d1403551d0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit martinthomson commented on this pull request. This all assumes use of `https`. That's probably an error because for `http` you have just provided a perfect hijacking mechanism. We already have enough of those for cleartext HTTP thanks very much :) I would strongly recommend explicitly limiting this feature to `https` based on the current changes. > @@ -101,49 +106,65 @@ REMOVE (0x2): The set of origins (as per {{!RFC6454}}) that a given connection might be used for is known in this specification as the Origin Set. -When a connection is first established, its Origin Set is defined to be those origins that the client would normally consider the connection authoritative for; see {{!RFC7540}}, Section 10.1. +When a connection is first established, its Origin Set is defined to be the origin composed from: + - Scheme: "https" + - Host: the value sent in Server Name Indication {{!RFC6066}} + - Port: the local port of the connection on the server + +If SNI is not sent, the Origin Set is empty when the connection is established. This is a retroactive change to h2. It says that you can't coalesce. It also says that you can't *use* a connection if you didn't use SNI. I think that you need to include some weasel-words about how this doesn't really apply until the first ORIGIN frame is sent or received. > 2. If the REMOVE flag is set, remove any member of the Origin Set that is the same as `parsed_origin` (as per {{!RFC6454}}, Section 5), and continue to the next `parsed_origin`. 3. Otherwise, add `parsed_origin` to the Origin Set. # Security Considerations Clients that blindly trust the ORIGIN frame's contents will be vulnerable to a large number of -attacks; hence the reinforcement that this specification does not relax the requirement for server -authority in {{?RFC7540}}, Section 10.1. +attacks. Rather than simple removal, I would add: > Though this document removes the requirement on clients to ensure that the DNS refers to the same IP address, it does not remove the requirement for certificate-based authentication. A client MUST validate a server IP address. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/pull/285#pullrequestreview-19514250 ----==_mimepart_5891b301eb45c_6dfb3ff6a5d5d1403551d0 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

@martinthomson commented on this pull request.

This all assumes use of https. That's probably an error because for http you have just provided a perfect hijacking mechanism. We already have enough of those for cleartext HTTP thanks very much :)

I would strongly recommend explicitly limiting this feature to https based on the current changes.

In draft-ietf-httpbis-origin-frame.md:

> @@ -101,49 +106,65 @@ REMOVE (0x2):
 The set of origins (as per {{!RFC6454}}) that a given connection might be used for is known in this
 specification as the Origin Set.
 
-When a connection is first established, its Origin Set is defined to be those origins that the client would normally consider the connection authoritative for; see {{!RFC7540}}, Section 10.1.
+When a connection is first established, its Origin Set is defined to be the origin composed from:
+  - Scheme: "https"
+  - Host: the value sent in Server Name Indication {{!RFC6066}}
+  - Port: the local port of the connection on the server
+
+If SNI is not sent, the Origin Set is empty when the connection is established.

This is a retroactive change to h2. It says that you can't coalesce. It also says that you can't use a connection if you didn't use SNI. I think that you need to include some weasel-words about how this doesn't really apply until the first ORIGIN frame is sent or received.

In draft-ietf-httpbis-origin-frame.md:

>     2. If the REMOVE flag is set, remove any member of the Origin Set that is the same as `parsed_origin` (as per {{!RFC6454}}, Section 5), and continue to the next `parsed_origin`.
    3. Otherwise, add `parsed_origin` to the Origin Set.
 
 
 # Security Considerations
 
 Clients that blindly trust the ORIGIN frame's contents will be vulnerable to a large number of
-attacks; hence the reinforcement that this specification does not relax the requirement for server
-authority in {{?RFC7540}}, Section 10.1.
+attacks.

Rather than simple removal, I would add:

Though this document removes the requirement on clients to ensure that the DNS refers to the same IP address, it does not remove the requirement for certificate-based authentication. A client MUST validate a server IP address.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_5891b301eb45c_6dfb3ff6a5d5d1403551d0-- From nobody Wed Feb 1 05:04:30 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -7.036 X-Spam-Level: X-Spam-Status: No, score=-7.036 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_24=1.618, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H2=-1.156, RP_MATCHES_RCVD=-3.199, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=github.com; h=from:reply-to:to:cc:in-reply-to:references:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=xwCLHyoYPWN11ci+nyFk62DIeY8=; b=BCe1tlU5YWYMrMY0 qOe7Csx7u67L0DXMiY8fpFo9pk3zEi6OwxorWd0io9MrYJwJmHI/Sjqbe8gEwVes WuJyWJr875QT3NVFPenSxN94YiK67n0kiqRhnD9Ir7ZgSwAfOvn+VtYggHdorJqb dQADdyG5Ai79PleC1pmZDVEhsmw= Date: Wed, 01 Feb 2017 05:04:12 -0800 To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] make title consistent with WG terminology (#277) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_5891dccca17f5_78e3fe3b18df138204c"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Feb 2017 13:04:29 -0000 ----==_mimepart_5891dccca17f5_78e3fe3b18df138204c Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit I have struggled with the naming from the start, and am open to any suggestions on that, with the single caveat that making the name too long is probably not a good idea without at good acronym. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/pull/277#issuecomment-276652251 ----==_mimepart_5891dccca17f5_78e3fe3b18df138204c Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

I have struggled with the naming from the start, and am open to any suggestions on that, with the single caveat that making the name too long is probably not a good idea without at good acronym.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

= ----==_mimepart_5891dd9ab3c4b_16b73f86ac88d138974be-- From nobody Wed Feb 1 05:08:38 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -6.037 X-Spam-Level: X-Spam-Status: No, score=-6.037 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_24=1.618, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H2=-1.156, RCVD_IN_SORBS_SPAM=0.5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Date: Wed, 01 Feb 2017 05:08:35 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1485954515; bh=7l4+qt2987cpIgD4OSdMTnKwkTmDRLesuY3/0Ih2/TY=; h=From:Reply-To:To:Cc:In-Reply-To:References:Subject:List-ID: List-Archive:List-Post:List-Unsubscribe:From; b=XqVTEVqIuTpeGA707AWZVA5fCO19n3sbZU8ZF2VMM2gJbv4OuD33adr+gGsny7Q5V K0zzIRHZBGLKAUJ5fqrP5hsLQUIuZklNah6lm+1ynuwhMJBVo3EjWJmJE6j4bRf/ta u7r8fh9S0dJqq4XkTKUvzoGHmOUNDj4TgaEM/v7U= To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] Can dictionary keys repeat? (#281) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_5891ddd3271d7_84a3f9fa01c514034231b"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Feb 2017 13:08:37 -0000 ----==_mimepart_5891ddd3271d7_84a3f9fa01c514034231b Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit I have added the following text: ``` Key identifiers in dictionaries SHALL be unique, but semantically overlapping key identifiers for instance 'text/plain' and 'text/*' are ok. ``` -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/issues/281#issuecomment-276653016 ----==_mimepart_5891ddd3271d7_84a3f9fa01c514034231b Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable

I have added the following text:

Key identifiers in dictionaries SHALL be unique, but semantica=
lly
overlapping key identifiers for instance 'text/plain' and 'text/*'
are ok.

&m= dash;
You are receiving this because you are subscribed to this thre= ad.
Reply to this email directly, view it on GitHub, or mute the thread.

=
= ----==_mimepart_5891ddd3271d7_84a3f9fa01c514034231b-- From nobody Wed Feb 1 05:08:44 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -7.036 X-Spam-Level: X-Spam-Status: No, score=-7.036 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_24=1.618, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H2=-1.156, RP_MATCHES_RCVD=-3.199, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=github.com; h=from:reply-to:to:cc:in-reply-to:references:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=fEX7/ZdWAcPKWgAfAqxg20Adc18=; b=bbuTPppgRw5BTmev kSNIFq1+0NUEmFDheI8sEyQB3q+xFk48Bj8x7BiN2UIe6EeuMPEFsDltEk374Gtc 1OxRZ48TM6RMyeO6OLky1CLdu1njFyX2FJZKiYAbOvQHjM8LV1Ce0jj7k/CBdHpe LsdGP5qvwHlXI1UGJ+j0jqPCuxk= Date: Wed, 01 Feb 2017 05:08:35 -0800 To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] Can dictionary keys repeat? (#281) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_5891ddd34462e_375e3f977e1d91384521df"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Feb 2017 13:08:38 -0000 ----==_mimepart_5891ddd34462e_375e3f977e1d91384521df Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Closed #281. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/issues/281#event-944709033 ----==_mimepart_5891ddd34462e_375e3f977e1d91384521df Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

Closed #281.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_5891ddd34462e_375e3f977e1d91384521df-- From nobody Wed Feb 1 14:38:42 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -3.6 X-Spam-Level: X-Spam-Status: No, score=-3.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_24=1.618, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-3.199, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=github.com; h=from:reply-to:to:cc:in-reply-to:references:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=bwUvA1qIloeUoEXkgK0t2nngfbU=; b=GFfg5WPV29RfHglo GixSv32Aq7JQAUBQV6Nf+Sz/J9npTFYuuJUfepPEYnCExK1Z5FP0MaJwOxEf65EX ifTaMa8CwDPAjrMmcDYmjZj+e5tayXIBt8pVbY+nuTfxpjNJEJ9zYCqtXl1fQnEN 4IXbh2QYRU7FBu5dFU/16VkDkOU= Date: Wed, 01 Feb 2017 14:38:02 -0800 To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] Can dictionary keys repeat? (#281) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_5892634a40c7b_424e3fe4af94d13433909d"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Feb 2017 22:38:41 -0000 ----==_mimepart_5892634a40c7b_424e3fe4af94d13433909d Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit This invalidates the choice in QUIC, see https://quicwg.github.io/base-drafts/draft-ietf-quic-http.html#rfc.section.2.1 -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/issues/281#issuecomment-276806055 ----==_mimepart_5892634a40c7b_424e3fe4af94d13433909d Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

This invalidates the choice in QUIC, see https://quicwg.github.io/base-drafts/draft-ietf-quic-http.html#rfc.section.2.1

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_5892634a40c7b_424e3fe4af94d13433909d-- From nobody Wed Feb 1 16:56:13 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -6.038 X-Spam-Level: X-Spam-Status: No, score=-6.038 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_24=1.618, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H2=-1.156, RCVD_IN_SORBS_SPAM=0.5, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Date: Wed, 01 Feb 2017 16:56:09 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1485996969; bh=UArMJnWKUgV9TXLOKaZRMA/uZaQrzaXrmuumzNspBUc=; h=From:Reply-To:To:Cc:In-Reply-To:References:Subject:List-ID: List-Archive:List-Post:List-Unsubscribe:From; b=bVIzFCtMb4nqbEN/5m/wGgD2mWIKW96RFUq3gK827lPivXoBd4kwp6v+boIvd+pQE KzIQae8/nlV56R9VeFxHCxvopJAWgV2vFYXMaAApTVasVMs4KR8VzeHKSSTpzmWkj0 2PD/GWRn3ZMa6VmbTjHm8Xi4hGr5oTqZoy+kQWiw= To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] DNS relaxation, smaller initial Origin Set (#285) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_589283a910a0f_f873fc3278d7140183677"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Push Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Feb 2017 00:56:12 -0000 ----==_mimepart_589283a910a0f_f873fc3278d7140183677 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit @mnot pushed 1 commit. eaa6a4b note unicode -- You are receiving this because you are subscribed to this thread. View it on GitHub: https://github.com/httpwg/http-extensions/pull/285/files/241ce50734215f15c7af2e65921e710d8f977638..eaa6a4bd547bcee8eabc9d72a535eea4f68c1aaa ----==_mimepart_589283a910a0f_f873fc3278d7140183677 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

@mnot pushed 1 commit.

—
You are receiving this because you are subscribed to this thread.
View it on GitHub or mute the thread.

----==_mimepart_589283a910a0f_f873fc3278d7140183677-- From nobody Wed Feb 1 18:20:49 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -7.037 X-Spam-Level: X-Spam-Status: No, score=-7.037 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_24=1.618, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H2=-1.156, RP_MATCHES_RCVD=-3.199, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=github.com; h=from:reply-to:to:cc:in-reply-to:references:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=h5Ruyr8/NCr+O0kWyUOHeKwZmAs=; b=dJhft9cFvZkSlk+T FaB/AXPXmBB1HRyMeGjQ9rF2CkSWI0hrOJ2Hvr/pQwpjfFYDcxhC6MHJkzCM1TRH EVXvEqRIq/+rtpsBje5/MxJcriXlOsFz7nYL5GE9Zf45TUC3PP66hEo2PdWQ8nW2 GWqg8hNPBdQePVOn2979PYTwF/8= Date: Wed, 01 Feb 2017 18:19:38 -0800 To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] DNS relaxation, smaller initial Origin Set (#285) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_5892973a13c3_261c3f8766fc713c366896"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Push Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Feb 2017 02:20:47 -0000 ----==_mimepart_5892973a13c3_261c3f8766fc713c366896 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit @mnot pushed 1 commit. de47d40 rewrite after discussion -- You are receiving this because you are subscribed to this thread. View it on GitHub: https://github.com/httpwg/http-extensions/pull/285/files/eaa6a4bd547bcee8eabc9d72a535eea4f68c1aaa..de47d40db2c9ca06eb98678e45ebab3f0253fda4 ----==_mimepart_5892973a13c3_261c3f8766fc713c366896 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

@mnot pushed 1 commit.

—
You are receiving this because you are subscribed to this thread.
View it on GitHub or mute the thread.

----==_mimepart_5892973a13c3_261c3f8766fc713c366896-- From nobody Wed Feb 1 18:24:03 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -6.538 X-Spam-Level: X-Spam-Status: No, score=-6.538 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_24=1.618, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H2=-1.156, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Date: Wed, 01 Feb 2017 18:23:59 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1486002239; bh=zsSvH+MX7a00LybEZ4FgB5NF8FuqWmJ0GKAxJYHEIu0=; h=From:Reply-To:To:Cc:In-Reply-To:References:Subject:List-ID: List-Archive:List-Post:List-Unsubscribe:From; b=zGBPiJnesWY8TyT/B9KXKYj1Y+YHJnepmZwWuUJFpf0VDnH2PYQgOvuj4Fu79MBm3 +OrT9sIvvXWeuRhHETDurPrWMRRX9LsyQS4WZ0FHMQ13i60rvqUM/DAorKpb6CIG/V Vo2CE1/tphIQO7obs5KWNPmVW8aTwFgS1ukChfKE= To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] DNS relaxation, smaller initial Origin Set (#285) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_5892983fdaf2b_6b583fa70675d1309429d"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Push Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Feb 2017 02:24:03 -0000 ----==_mimepart_5892983fdaf2b_6b583fa70675d1309429d Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit @mnot pushed 1 commit. 8171ff1 fix ref -- You are receiving this because you are subscribed to this thread. View it on GitHub: https://github.com/httpwg/http-extensions/pull/285/files/de47d40db2c9ca06eb98678e45ebab3f0253fda4..8171ff1cd2d252a7a25980c510f1e9401b6a4339 ----==_mimepart_5892983fdaf2b_6b583fa70675d1309429d Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

@mnot pushed 1 commit.

—
You are receiving this because you are subscribed to this thread.
View it on GitHub or mute the thread.

----==_mimepart_5892983fdaf2b_6b583fa70675d1309429d-- From nobody Wed Feb 1 18:30:44 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -4.515 X-Spam-Level: X-Spam-Status: No, score=-4.515 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_28=1.404, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-3.199, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=github.com; h=from:reply-to:to:cc:in-reply-to:references:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=rsJM2cdTPHrpoTimF/jRVaQNaFo=; b=BEffx1lUQh2hqqLo fUMdaG7uLSIZgHAdNmXzwWnvli4FCqzXuKy9+9ixCehf0jseQ7uh/zTxwyKk4IXx eUxWwWphqZAwt0znK+PkLqzOm+w8pP16HCTrayI6BfcnU3lr/f1S7W8m/b+WuD8M 0nBmzD/Mu6XolcvxcGOCQB/938k= Date: Wed, 01 Feb 2017 18:30:40 -0800 To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] rewrite after discussion (de47d40) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_589299d01d06c_78373fb82e3391382571aa"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Feb 2017 02:30:43 -0000 ----==_mimepart_589299d01d06c_78373fb82e3391382571aa Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit A client won't be able to tell this, and that is what matters in terms of checking. You really want to include the remote port at the client. That leaves a server with the difficult problem of knowing how it is identified, but that's a problem they have already. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/commit/de47d40db2c9ca06eb98678e45ebab3f0253fda4#commitcomment-20707392 ----==_mimepart_589299d01d06c_78373fb82e3391382571aa Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable

A client won't be able to tell this, and that is what matters in terms o= f checking. You really want to include the remote port at the client. Tha= t leaves a server with the difficult problem of knowing how it is identifie= d, but that's a problem they have already.

&mda= sh;
You are receiving this because you are subscribed to this thread.<= br />Reply to this email directly, view it on GitHub, or mute the thread.3D""

= ----==_mimepart_589299d01d06c_78373fb82e3391382571aa-- From nobody Wed Feb 1 18:31:50 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -7.037 X-Spam-Level: X-Spam-Status: No, score=-7.037 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_24=1.618, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H2=-1.156, RP_MATCHES_RCVD=-3.199, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=github.com; h=from:reply-to:to:cc:in-reply-to:references:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=lmmSjv0rZffzexyIGqn6WCeS1c0=; b=dBVKnh0Yk1VcgHkm chMqIruXKTD+y5wUwcrNWBGXlKDjfztM7FFJFyk/bkWmzoJQnO0L3IhcTncYmCcs W6RrfqJwRlIPxCDWbknaBJpYCyHY/uEHYX9rWZFZudpyXZyxmxP2HrCbqw0jks2r PCwN+Z5lPexXOlTolGneN7FaP74= Date: Wed, 01 Feb 2017 18:30:47 -0800 To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] DNS relaxation, smaller initial Origin Set (#285) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_589299d7b1f6a_38973ffbc2d8114011657e"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Push Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Feb 2017 02:31:49 -0000 ----==_mimepart_589299d7b1f6a_38973ffbc2d8114011657e Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit @mnot pushed 1 commit. 835e8d9 Update 5987bis.md -- You are receiving this because you are subscribed to this thread. View it on GitHub: https://github.com/httpwg/http-extensions/pull/285/files/8171ff1cd2d252a7a25980c510f1e9401b6a4339..835e8d99bc357101a8869a1415b4cdacb69f2a15 ----==_mimepart_589299d7b1f6a_38973ffbc2d8114011657e Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

@mnot pushed 1 commit.

—
You are receiving this because you are subscribed to this thread.
View it on GitHub or mute the thread.

----==_mimepart_589299d7b1f6a_38973ffbc2d8114011657e-- From nobody Wed Feb 1 18:33:05 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -6.11 X-Spam-Level: X-Spam-Status: No, score=-6.11 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_20=1.546, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H2=-1.156, RCVD_IN_SORBS_SPAM=0.5, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Date: Wed, 01 Feb 2017 18:33:02 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1486002782; bh=tfzxqKYZkSi6hJASgk+59oDt66YDXv6zGuWIxX8TwxI=; h=From:Reply-To:To:Cc:In-Reply-To:References:Subject:List-ID: List-Archive:List-Post:List-Unsubscribe:From; b=Eg3ZCEHtzXlESmDvL+qxux6xjXGyU3d125pr9H5xtL8iVEH52wXxaiJuen9B5B5Hn lvQS9vQI/C3l5PNUpUj87qGI643rXquQObQEpiblk2ZetcCvHlr8s0re93+zRBR0De L44gTTW5Y1vhnmEiB+Vf0T8TY3udezUNU27JiG7A= To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] rewrite after discussion (de47d40) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_58929a5e5ea13_55ca3fca7ef0d13c389550"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Feb 2017 02:33:04 -0000 ----==_mimepart_58929a5e5ea13_55ca3fca7ef0d13c389550 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Thhpt. Yes. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/commit/de47d40db2c9ca06eb98678e45ebab3f0253fda4#commitcomment-20707408 ----==_mimepart_58929a5e5ea13_55ca3fca7ef0d13c389550 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

Thhpt. Yes.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_58929a5e5ea13_55ca3fca7ef0d13c389550-- From nobody Wed Feb 1 18:34:38 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -8.155 X-Spam-Level: X-Spam-Status: No, score=-8.155 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_32=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H2=-1.156, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Date: Wed, 01 Feb 2017 18:34:34 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1486002874; bh=O5yCcPc6rZTSfiLSKZUqcBzq2esc5QE9kyArEecIszA=; h=From:Reply-To:To:Cc:In-Reply-To:References:Subject:List-ID: List-Archive:List-Post:List-Unsubscribe:From; b=FGJEMleEEvEPQysWzcOD2sYLM60zc8HYg/tlKFj7TIS/Es41C2O2773LUSNJIAkwN sW5iTc9hkReoDoqjrl+XoftY7U/5M9fQDc4Wfgh4x1o4aM2U21KHuNtTHXMm/J1F6x JneUpG+zkB5DDS1kQG8QCUZckcUsznGeiBkCWbq8= To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] rewrite after discussion (de47d40) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_58929abac8bbf_5da73fc51d35b13834444c"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Feb 2017 02:34:37 -0000 ----==_mimepart_58929abac8bbf_5da73fc51d35b13834444c Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit In being specific, you have avoided a bunch of secondary checks that we might perform on a connection for a given name. We avoided being specific in HTTP/2 by saying: > The certificate presented by the server MUST satisfy any checks that the client would perform when forming a new TLS connection for the host in the URI. That applies here. The problem with this text is that it is necessary, but not sufficient. The simplest example being that the SAN could be correct, but the domain name might be pinned to a different intermediate CA. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/commit/de47d40db2c9ca06eb98678e45ebab3f0253fda4#commitcomment-20707417 ----==_mimepart_58929abac8bbf_5da73fc51d35b13834444c Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable

In being specific, you have avoided a bunch of secondary checks that w= e might perform on a connection for a given name. We avoided being speci= fic in HTTP/2 by saying:

The certificate presented by the server MUST satisfy any checks that t= he client would perform when forming a new TLS connection for the host in= the URI.

That applies here.

The problem with this text is that it is necessary, but not sufficient= . The simplest example being that the SAN could be correct, but the doma= in name might be pinned to a different intermediate CA.

&m= dash;
You are receiving this because you are subscribed to this thre= ad.
Reply to this email directly, view it on GitHub, or mute the thread.3D""

= ----==_mimepart_58929abac8bbf_5da73fc51d35b13834444c-- From nobody Wed Feb 1 18:35:18 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -3.601 X-Spam-Level: X-Spam-Status: No, score=-3.601 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_24=1.618, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-3.199, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=github.com; h=from:reply-to:to:cc:in-reply-to:references:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=Xlg4MT3guEu7jBQz4egc2D3tTUs=; b=W6UC4ABcx2CBYMrU 1LVq1SDROLRN60EYN7MMNAFJhpTas6UdiByzHelk57PEXG2QzBmmaDKhLr6YebS9 gW6sOhQEATxADUnN+psmfYS0AsQ1jRM5oEes3bujCVFDLgizFDEBXHAyG5nG9+/U LurRpzGchuudnr/ZLyiY+EMAYSE= Date: Wed, 01 Feb 2017 18:35:12 -0800 To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] DNS relaxation, smaller initial Origin Set (#285) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_58929ae03a78e_45c3f9b5de6313c3039a4"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Push Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Feb 2017 02:35:18 -0000 ----==_mimepart_58929ae03a78e_45c3f9b5de6313c3039a4 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit @mnot pushed 1 commit. d4bf661 local -> remote -- You are receiving this because you are subscribed to this thread. View it on GitHub: https://github.com/httpwg/http-extensions/pull/285/files/835e8d99bc357101a8869a1415b4cdacb69f2a15..d4bf661368ff53a5a49c4d67e4c93348513c8a42 ----==_mimepart_58929ae03a78e_45c3f9b5de6313c3039a4 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

@mnot pushed 1 commit.

—
You are receiving this because you are subscribed to this thread.
View it on GitHub or mute the thread.

----==_mimepart_58929ae03a78e_45c3f9b5de6313c3039a4-- From nobody Wed Feb 1 18:37:40 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -3.601 X-Spam-Level: X-Spam-Status: No, score=-3.601 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_24=1.618, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-3.199, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=github.com; h=from:reply-to:to:cc:in-reply-to:references:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=quq/WET6xzSr5PDIGn48mF0HzRg=; b=XxKOKMqcPVcG99xm nxUqOofkW14P3BQT8SWbk3MWDWXa+6yM5P381oW3BfcO4CxIDfDzkEn/Hwg6mXSV 97VgcoBcJKUV3pcIIl8JjqPDm2FXyiaPY5M7JhjF799GEzZRtOrJRR4KmsAHBxXj l/db70nvYoH0cl3w5af+ts4zS6A= Date: Wed, 01 Feb 2017 18:36:38 -0800 To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] rewrite after discussion (de47d40) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_58929b36d3d1b_62583fc7dc0ed13c23060"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Feb 2017 02:37:39 -0000 ----==_mimepart_58929b36d3d1b_62583fc7dc0ed13c23060 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit This is expressed as a delta from the rules in 7540 and elsewhere; they still apply. In particular, this check is being made upon receipt of the origin frame, NOT when the connection is established. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/commit/de47d40db2c9ca06eb98678e45ebab3f0253fda4#commitcomment-20707434 ----==_mimepart_58929b36d3d1b_62583fc7dc0ed13c23060 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable

This is expressed as a delta from the rules in 7540 and elsewhere; they = still apply. In particular, this check is being made upon receipt of the or= igin frame, NOT when the connection is established.

&mda= sh;
You are receiving this because you are subscribed to this thread.<= br />Reply to this email directly, view it on GitHub, or mute the thread.3D""

= ----==_mimepart_58929b36d3d1b_62583fc7dc0ed13c23060-- From nobody Wed Feb 1 18:38:56 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -3.601 X-Spam-Level: X-Spam-Status: No, score=-3.601 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_24=1.618, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-3.199, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=github.com; h=from:reply-to:to:cc:in-reply-to:references:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=rlNIVd7fRF3oSR+shkHdnoAYE2o=; b=oCSJ0UupVlJqj6FY DzvRUVOTTGQnAFule8CbxHf61DHdmwi+/obs4vxPrmD1BVsoJDBqlmRhMWCWSSC6 q3wCN6XxEZGa9ELv18iuztUUcl6+5okRvkUn4xZtqep3/ZMPklAWtbSub5jlq51Z JXumTrUUFJ2YS2qvMSF8TJVnRgw= Date: Wed, 01 Feb 2017 18:38:51 -0800 To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] DNS relaxation, smaller initial Origin Set (#285) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_58929bbba264f_54c13fd18ef0913833281e"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Push Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Feb 2017 02:38:55 -0000 ----==_mimepart_58929bbba264f_54c13fd18ef0913833281e Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit @mnot pushed 1 commit. 6529f68 add placeholder for IANA considerations. -- You are receiving this because you are subscribed to this thread. View it on GitHub: https://github.com/httpwg/http-extensions/pull/285/files/d4bf661368ff53a5a49c4d67e4c93348513c8a42..6529f681194b5d70612865b8dd1a36aeea7451eb ----==_mimepart_58929bbba264f_54c13fd18ef0913833281e Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

@mnot pushed 1 commit.

  • 6529f68 add placeholder for IANA considerations.

—
You are receiving this because you are subscribed to this thread.
View it on GitHub or mute the thread.

----==_mimepart_58929bbba264f_54c13fd18ef0913833281e-- From nobody Wed Feb 1 18:39:17 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -6.538 X-Spam-Level: X-Spam-Status: No, score=-6.538 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_24=1.618, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H2=-1.156, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Date: Wed, 01 Feb 2017 18:39:13 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1486003153; bh=RJ/yMObMMmWvXP9tD7UCjYY0pDeDOPXlw8b6URFs7fY=; h=From:Reply-To:To:Cc:In-Reply-To:References:Subject:List-ID: List-Archive:List-Post:List-Unsubscribe:From; b=ToLhpLUNI2Xdoz+Lp6g/4Ok1nADwf6NCLrcSpQfW4ucSTh9BTOHqGE5PmOeI+1q+8 s/z2l8MBSUW0hYhSs5IUsfQbNtWzxeBvZk8nHbzuDT6U7g2dnIW1azT0bRzSkEM5Gt riP/jlggsMilTEDhPD0Fh9yKLlj2TDk2hONWtLrA= To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] DNS relaxation, smaller initial Origin Set (#285) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_58929bd1aef5e_23ab3ffbc2d81140314181"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Push Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Feb 2017 02:39:16 -0000 ----==_mimepart_58929bd1aef5e_23ab3ffbc2d81140314181 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit @mnot pushed 1 commit. 6b932b2 I spel gud -- You are receiving this because you are subscribed to this thread. View it on GitHub: https://github.com/httpwg/http-extensions/pull/285/files/6529f681194b5d70612865b8dd1a36aeea7451eb..6b932b2a5fca88705afabb23f938afe8d81129fe ----==_mimepart_58929bd1aef5e_23ab3ffbc2d81140314181 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

@mnot pushed 1 commit.

—
You are receiving this because you are subscribed to this thread.
View it on GitHub or mute the thread.

----==_mimepart_58929bd1aef5e_23ab3ffbc2d81140314181-- From nobody Wed Feb 1 19:11:07 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -6.038 X-Spam-Level: X-Spam-Status: No, score=-6.038 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_24=1.618, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H2=-1.156, RCVD_IN_SORBS_SPAM=0.5, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Date: Wed, 01 Feb 2017 19:11:00 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1486005060; bh=YIPEyiBR2hoRgRGhv9fHClafWyMoERzk+AbHeW+lK/U=; h=From:Reply-To:To:Cc:In-Reply-To:References:Subject:List-ID: List-Archive:List-Post:List-Unsubscribe:From; b=V0v8dgfici2HBa094feiyALm1IZ8en+kqXlVREA71RvI8hRfWPeXfChDcEs9Y1hJL oYiPArV+Yvf35ful404IPrJXjeHPKtwr7BVT7Zs7zZUhR30Q7cAltGH95ssAQQa1ZK ekyi9+M3sUJjK0xPIq9W8MZjpMKqcDF/3wcOfGUY= To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] rewrite after discussion (de47d40) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_5892a3445883d_434b3fc7dc0ed13c258030"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Feb 2017 03:11:05 -0000 ----==_mimepart_5892a3445883d_434b3fc7dc0ed13c258030 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit It implies more than that by restating a subset of those rules. And the same rules need to apply upon receipt of ORIGIN as they do at connection establishment time. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/commit/de47d40db2c9ca06eb98678e45ebab3f0253fda4#commitcomment-20707677 ----==_mimepart_5892a3445883d_434b3fc7dc0ed13c258030 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable

It implies more than that by restating a subset of those rules. And t= he same rules need to apply upon receipt of ORIGIN as they do at connecti= on establishment time.

&m= dash;
You are receiving this because you are subscribed to this thre= ad.
Reply to this email directly, view it on GitHub, or mute the thread.3D""

= ----==_mimepart_5892a3445883d_434b3fc7dc0ed13c258030-- From nobody Wed Feb 1 19:22:01 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -6.11 X-Spam-Level: X-Spam-Status: No, score=-6.11 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_20=1.546, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H2=-1.156, RCVD_IN_SORBS_SPAM=0.5, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Date: Wed, 01 Feb 2017 19:21:58 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1486005718; bh=+hcR4WIYS+GTs23CEo5kUWVTAb+ykyE8Srpc9fNTIHE=; h=From:Reply-To:To:Cc:In-Reply-To:References:Subject:List-ID: List-Archive:List-Post:List-Unsubscribe:From; b=VTAOjt7pmlg4lF7OoyB/PnCGZjtHPUYlRdjIPSZARC42bQxW2hnIfN4H0zdJBkbd9 oDAt0pYKR42mvKwN7KS0Q0bxrbcEO4metzOzBAF2gmICOvu019XL8+fj03Sssp5z/Z MJT76I+w8yFKowZUSmwr2eZ4AnOiYrEzUm0Fba5M= To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] rewrite after discussion (de47d40) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_5892a5d64f0a_73123f9b5de6313c3398d"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Feb 2017 03:22:00 -0000 ----==_mimepart_5892a5d64f0a_73123f9b5de6313c3398d Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit All right, I'll add a "Note that...". -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/commit/de47d40db2c9ca06eb98678e45ebab3f0253fda4#commitcomment-20707749 ----==_mimepart_5892a5d64f0a_73123f9b5de6313c3398d Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

All right, I'll add a "Note that...".

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_5892a5d64f0a_73123f9b5de6313c3398d-- From nobody Wed Feb 1 19:55:28 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -6.038 X-Spam-Level: X-Spam-Status: No, score=-6.038 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_24=1.618, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H2=-1.156, RCVD_IN_SORBS_SPAM=0.5, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Date: Wed, 01 Feb 2017 19:55:23 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1486007723; bh=p8+HqWGzu0QUtJJzWOTeqRlzpZ/OLxModqX7E1/4Gl4=; h=From:Reply-To:To:Cc:In-Reply-To:References:Subject:List-ID: List-Archive:List-Post:List-Unsubscribe:From; b=lGOOurczOKFlbPmaSBcfPHT8wWFwnorBw3hS3wPUIG0egw2oHC4CboBKwh62OkS1Y LSTZ2P4CqUISY2w+J8AFfB5yD7KFuVMcT9Q2cSzcQ+hTm3h1NvaQyzpu2d3Ib38vCx 59MsmrcsVXcXYcdPusIbavhwu+on9/yKp4OsEBBg= To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] DNS relaxation, smaller initial Origin Set (#285) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_5892adabaf231_4ca23f8766fc713c153822"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Push Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Feb 2017 03:55:26 -0000 ----==_mimepart_5892adabaf231_4ca23f8766fc713c153822 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit @mnot pushed 1 commit. 91b2a4e add "note that..." -- You are receiving this because you are subscribed to this thread. View it on GitHub: https://github.com/httpwg/http-extensions/pull/285/files/6b932b2a5fca88705afabb23f938afe8d81129fe..91b2a4e57d70967452c9e56617ff40ac27b1c1f8 ----==_mimepart_5892adabaf231_4ca23f8766fc713c153822 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

@mnot pushed 1 commit.

—
You are receiving this because you are subscribed to this thread.
View it on GitHub or mute the thread.

----==_mimepart_5892adabaf231_4ca23f8766fc713c153822-- From nobody Wed Feb 1 20:04:46 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -3.601 X-Spam-Level: X-Spam-Status: No, score=-3.601 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_24=1.618, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-3.199, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=github.com; h=from:reply-to:to:cc:in-reply-to:references:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=JcqtKXUkpBXdpdh8TJouuRd85Lc=; b=eT1ld7/OP7yuNdD3 9GE8kMUU941BLXhMMDzeK71y81xRuOjb/LFRw9OQ4e2I/X9eUiFu5vw2vgyvKktj YDXApZD43tMoi2uizOw5a5UecA/ABdYcceDfot56SJj6fsgeoQiDHFbZK2g3b8Vr dKfH91/uIZWcgh9d3ON4bFy3mDQ= Date: Wed, 01 Feb 2017 20:04:41 -0800 To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] add "note that..." (91b2a4e) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_5892afd92734e_2f63fd18ef0913820709d"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Feb 2017 04:04:45 -0000 ----==_mimepart_5892afd92734e_2f63fd18ef0913820709d Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit I think that you intended to include this after the algorithm. The text here only says that the client uses the server certificate to establish authority. This bit is perfectly fine. My objection was to the algorithm being so specific. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/commit/91b2a4e57d70967452c9e56617ff40ac27b1c1f8#commitcomment-20708043 ----==_mimepart_5892afd92734e_2f63fd18ef0913820709d Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable

I think that you intended to include this after the algorithm. The text= here only says that the client uses the server certificate to establish au= thority. This bit is perfectly fine. My objection was to the algorithm be= ing so specific.

&mda= sh;
You are receiving this because you are subscribed to this thread.<= br />Reply to this email directly, view it on GitHub, or mute the thread.3D""

= ----==_mimepart_5892afd92734e_2f63fd18ef0913820709d-- From nobody Wed Feb 1 22:21:54 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -3.601 X-Spam-Level: X-Spam-Status: No, score=-3.601 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_24=1.618, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-3.199, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=github.com; h=from:reply-to:to:cc:in-reply-to:references:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=qFiHE16uQDY/y0YKJfixjnXDx8Q=; b=NEpAxiQAYirsl2AF Y5HFLuPYGaiMeHqeuNP6bvYUB3lTFpztUt8NvrDCMYaquEgKX7CekehiYId1BROn rsUwRPM6GGH2m2ikPTe3dhbaUMnY02wme5CFHq2eByusv2Us7/y9XVSUOHa/pMqy n6yqawnzpppx26K4hu6CC6vp3NE= Date: Wed, 01 Feb 2017 22:21:49 -0800 To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] DNS relaxation, smaller initial Origin Set (#285) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_5892cffdb44b3_11983fbf4b62913018555"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Push Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Feb 2017 06:21:53 -0000 ----==_mimepart_5892cffdb44b3_11983fbf4b62913018555 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit @mnot pushed 1 commit. 227694d more HTTPS getout clause -- You are receiving this because you are subscribed to this thread. View it on GitHub: https://github.com/httpwg/http-extensions/pull/285/files/91b2a4e57d70967452c9e56617ff40ac27b1c1f8..227694d092a8ce0fc88d044bdba8c0e4530eb2a9 ----==_mimepart_5892cffdb44b3_11983fbf4b62913018555 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

@mnot pushed 1 commit.

—
You are receiving this because you are subscribed to this thread.
View it on GitHub or mute the thread.

----==_mimepart_5892cffdb44b3_11983fbf4b62913018555-- From nobody Wed Feb 1 22:37:41 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -6.52 X-Spam-Level: X-Spam-Status: No, score=-6.52 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RCVD_IN_SORBS_SPAM=0.5, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Date: Wed, 01 Feb 2017 22:37:34 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1486017454; bh=wqMJOBzwHok+sn3RIIJveBmLebFOqUS3ho9POjzurRU=; h=From:Reply-To:To:Cc:In-Reply-To:References:Subject:List-ID: List-Archive:List-Post:List-Unsubscribe:From; b=Mzyp4Z1n7ECZpu5vLBa2wYWtRoubuFZfLvnEiEQppfIvl0B9dsvBIa50ragdJXtom RAFD3vKqwiPoLyba0PLAsDyY0RwgJ+ONQ4J9LCU+P/3y1ClgktoBA2D7D+3k/XaWPe 8xxffKtDkQFvY+RrZi059KrtD4Bb9IkrOTkvdq7U= To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] more HTTPS getout clause (227694d) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_5892d3ae65325_1a283fca8cd31134906f8"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Feb 2017 06:37:38 -0000 ----==_mimepart_5892d3ae65325_1a283fca8cd31134906f8 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit I'm sure that you're enjoying this as much as I am. I'm sorry for being a huge pedant^WPITA, but this isn't right. This is a non-statement: SNI is mandatory in HTTP/2 and if the connection isn't up to snuff, it will never reach the point that an ORIGIN frame can be received. I think that you need to change step 4.3 below. Maybe: > If the certificate presented by the server is not valid for the `host` of `parsed_origin`, skip to the next `origin_raw`. The certificate presented by the server is valid for `host` if it passes the checks that the client would perform when forming a new TLS connection to the origin. This includes verifying that the `host` matches a `dNSName` value from the certificate `subjectAltName` field (using the wildcard rules defined in {{!RFC2818}}). We had a pretty bad bug in Firefox because we performed one set of checks for Alt-Svc, but failed to perform some fairly critical checks. I don't want to see a repeat of that. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/commit/227694d092a8ce0fc88d044bdba8c0e4530eb2a9#commitcomment-20709189 ----==_mimepart_5892d3ae65325_1a283fca8cd31134906f8 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable

I'm sure that you're enjoying this as much as I am. I'm sorry for bei= ng a huge pedant^WPITA, but this isn't right.

This is a non-statement: SNI is mandatory in HTTP/2 and if the connect= ion isn't up to snuff, it will never reach the point that an ORIGIN frame= can be received.

I think that you need to change step 4.3 below. Maybe:

If the certificate presented by the server is not valid for the = host of parsed_origin, skip to the next origin_= raw. The certificate presented by the server is valid for ho= st if it passes the checks that the client would perform when form= ing a new TLS connection to the origin. This includes verifying that the= host matches a dNSName value from the certific= ate subjectAltName field (using the wildcard rules defined i= n {{!RFC2818}}).

We had a pretty bad bug in Firefox because we performed one set of che= cks for Alt-Svc, but failed to perform some fairly critical checks. I do= n't want to see a repeat of that.

&m= dash;
You are receiving this because you are subscribed to this thre= ad.
Reply to this email directly, view it on GitHub, or mute the thread.3D""

= ----==_mimepart_5892d3ae65325_1a283fca8cd31134906f8-- From nobody Thu Feb 2 15:55:49 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -4.809 X-Spam-Level: X-Spam-Status: No, score=-4.809 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_20=1.546, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-1.156, RP_MATCHES_RCVD=-3.199, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=github.com; h=from:reply-to:to:cc:in-reply-to:references:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=cl2LtzWtApWQ9/0G1Dt1h0xESS0=; b=UUU1jnaMMlK0p2k4 OWW3WZPHbo2XXyP/4qoJdZmRavRWffDM/mb6BslS1jYmzSZHmKTHjtZgJWNuPf7w Hp23naFXoTPfgFFz2/zU2ZaasJI7aiW4AhM+lYmACcpliU2S1x7RCSH2jp66g8wA rdjnLTUv+9VcwLLOA6FjzWZ2Wi4= Date: Thu, 02 Feb 2017 15:55:23 -0800 To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] more HTTPS getout clause (227694d) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_5893c6ebe1339_7bcd3fbd9e7811305853b"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Feb 2017 23:55:48 -0000 ----==_mimepart_5893c6ebe1339_7bcd3fbd9e7811305853b Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit It's a non-normative section, but OK. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/commit/227694d092a8ce0fc88d044bdba8c0e4530eb2a9#commitcomment-20723464 ----==_mimepart_5893c6ebe1339_7bcd3fbd9e7811305853b Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

It's a non-normative section, but OK.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_5893c6ebe1339_7bcd3fbd9e7811305853b-- From nobody Thu Feb 2 15:56:35 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -7.251 X-Spam-Level: X-Spam-Status: No, score=-7.251 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_28=1.404, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H2=-1.156, RP_MATCHES_RCVD=-3.199, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=github.com; h=from:reply-to:to:cc:in-reply-to:references:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=xgcGW+DwBnXHN8TsQJECkl1gh6g=; b=L43gPwCrVjPTSFE5 a4aVLM9/L3Zh/DtxmFllRr9U9XgOn3Kfp1J1iEbDg0IJaZ/5pc7IAA+0d3Fr8Vi2 19hWmEitMMiTrmPnILbLB26cStn1rw6HsjnZwFx/eaWdcTj70xaoGeTJngGgGq97 UXqs1SaR3AVQwx8AQh+rqTl4q5Y= Date: Thu, 02 Feb 2017 15:55:44 -0800 To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] DNS relaxation, smaller initial Origin Set (#285) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_5893c70014b50_4c2c3fcec5c8113413252a"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Push Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Feb 2017 23:56:34 -0000 ----==_mimepart_5893c70014b50_4c2c3fcec5c8113413252a Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit @mnot pushed 3 commits. 66463b0 - Reserve some flags for backwards-incompatible changes a77c322 add IANA considerations 4d3cf21 Martin's suggestion (modified) -- You are receiving this because you are subscribed to this thread. View it on GitHub: https://github.com/httpwg/http-extensions/pull/285/files/227694d092a8ce0fc88d044bdba8c0e4530eb2a9..4d3cf21550ed4dc84cd6d802e5ae24e7a01c412f ----==_mimepart_5893c70014b50_4c2c3fcec5c8113413252a Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

@mnot pushed 3 commits.

  • 66463b0 - Reserve some flags for backwards-incompatible changes
  • a77c322 add IANA considerations
  • 4d3cf21 Martin's suggestion (modified)

—
You are receiving this because you are subscribed to this thread.
View it on GitHub or mute the thread.

----==_mimepart_5893c70014b50_4c2c3fcec5c8113413252a-- From nobody Thu Feb 2 16:37:22 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -3.814 X-Spam-Level: X-Spam-Status: No, score=-3.814 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_28=1.404, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-3.199, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=github.com; h=from:reply-to:to:cc:in-reply-to:references:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=Ak8WiDmT6sm+PqoFjDM7g5c0VhA=; b=ukGljaN1aobRDA0f FmxKUcsGdYhlajbL/UB79RORBIh5m7geThzR3oP1R6Fd5FuYtRwj6M38D8WI4hGh esZxv7DyZBy/59Slh6D5SUpT6IpCs372jqZI6suKBQZziyseh4eEIutA0yUFZwnw cMykyHrbe7Avs6QpFYD07lmuEqY= Date: Thu, 02 Feb 2017 16:37:17 -0800 To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] DNS relaxation, smaller initial Origin Set (#285) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_5893d0bd7a067_3f13f84fd389138127875"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Push Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 03 Feb 2017 00:37:21 -0000 ----==_mimepart_5893d0bd7a067_3f13f84fd389138127875 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit @mnot pushed 5 commits. b2a7bc2 change TLS step f27c5e0 Tweak "initialised" 31fea62 add operational considerations 0b6affa talk about conn de-duplication 8afa09b clarify -- You are receiving this because you are subscribed to this thread. View it on GitHub: https://github.com/httpwg/http-extensions/pull/285/files/4d3cf21550ed4dc84cd6d802e5ae24e7a01c412f..8afa09b580bf52df234522ce8397e67ff8274e76 ----==_mimepart_5893d0bd7a067_3f13f84fd389138127875 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

@mnot pushed 5 commits.

—
You are receiving this because you are subscribed to this thread.
View it on GitHub or mute the thread.

----==_mimepart_5893d0bd7a067_3f13f84fd389138127875-- From nobody Thu Feb 2 16:40:31 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -3.6 X-Spam-Level: X-Spam-Status: No, score=-3.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_24=1.618, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-3.199, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=github.com; h=from:reply-to:to:cc:in-reply-to:references:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=B62yZARw3m+lNsh1KYEaQZZV8IQ=; b=KT4WC7Evv7voUqAI jXZDKbLx1EqmvJZgCSFuDbRFt0atW1EwzhneU3ClgQXmb3lbcNu+Bi1DQcEMrt+a MP8qjWlcYhTi27StE48u7499WsWpnZK5//v5e+bVveDAlyFWUhsMSdSliff2K0wG m4wktWlPBWBgJanLCeHGG8I/PkY= Date: Thu, 02 Feb 2017 16:40:27 -0800 To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] - Reserve some flags for backwards-incompatible changes (66463b0) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_5893d17bc813a_ef43fd1f35691406729b"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 03 Feb 2017 00:40:30 -0000 ----==_mimepart_5893d17bc813a_ef43fd1f35691406729b Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit I would state here that an ORIGIN flag with frames set is ignored unless the flag semantics are understood. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/commit/66463b0fc1da7d00ba5ba44c6513db4cd2b0209e#commitcomment-20723822 ----==_mimepart_5893d17bc813a_ef43fd1f35691406729b Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

I would state here that an ORIGIN flag with frames set is ignored unless the flag semantics are understood.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_5893d17bc813a_ef43fd1f35691406729b-- From nobody Thu Feb 2 16:44:10 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -5.401 X-Spam-Level: X-Spam-Status: No, score=-5.401 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_24=1.618, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Date: Thu, 02 Feb 2017 16:44:05 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1486082645; bh=1XruufWalVmA/32HoMI6bPQixv4/XW8D9vBfx4gZnw4=; h=From:Reply-To:To:Cc:In-Reply-To:References:Subject:List-ID: List-Archive:List-Post:List-Unsubscribe:From; b=p04j3618n0io8qwz4dvM1AYqpiURGEQFRSblO4V1vLidKA+hKtFagZKlYHXSpyWMD OA6YVcBpiOfpBUIIRNtS5QTqj9ZS3962fRGe2tfYzBgDEnPQE9+wszvxwsDRtpwx4K sSeva3N9BfWrTB0aosNw37oNN0ri0tnqsUDl318I= To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] - Reserve some flags for backwards-incompatible changes (66463b0) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_5893d255476a9_14cd3fe4618b113817775b"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 03 Feb 2017 00:44:08 -0000 ----==_mimepart_5893d255476a9_14cd3fe4618b113817775b Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit See later. I split the flags into backwards-compatible and backwards-incompatible, since it's not clear what kind of semantics we might need in the future. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/commit/66463b0fc1da7d00ba5ba44c6513db4cd2b0209e#commitcomment-20723848 ----==_mimepart_5893d255476a9_14cd3fe4618b113817775b Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

See later. I split the flags into backwards-compatible and backwards-incompatible, since it's not clear what kind of semantics we might need in the future.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_5893d255476a9_14cd3fe4618b113817775b-- From nobody Thu Feb 2 16:57:18 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -6.609 X-Spam-Level: X-Spam-Status: No, score=-6.609 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_20=1.546, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H2=-1.156, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Date: Thu, 02 Feb 2017 16:56:48 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1486083408; bh=ynoudXEJxImP+u2RkF63CqkEnCoJWMfQndJE9J7PIgw=; h=From:Reply-To:To:Cc:In-Reply-To:References:Subject:List-ID: List-Archive:List-Post:List-Unsubscribe:From; b=HKxGSONNmNHU5+EB6N+pF7uslvo1iW3TLgWSAnrJR+PyxCfTNUxYEN3gZcHOG2GI0 CGTSQgU8LMNtRgwTqPKRwnHQTumBiUr5ApsNr7O2rzdDsxkJbtMxse+cf6QebniODj v67b40zhHJ0UjqMCqFnFIO58mLldiJisxvMlU53M= To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] DNS relaxation, smaller initial Origin Set (#285) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_5893d550d4dca_67d03fb691bab13429284"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 03 Feb 2017 00:56:53 -0000 ----==_mimepart_5893d550d4dca_67d03fb691bab13429284 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit martinthomson approved this pull request. This is looking good. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/pull/285#pullrequestreview-19929547 ----==_mimepart_5893d550d4dca_67d03fb691bab13429284 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

@martinthomson approved this pull request.

This is looking good.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_5893d550d4dca_67d03fb691bab13429284-- From nobody Thu Feb 2 17:53:26 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -6.609 X-Spam-Level: X-Spam-Status: No, score=-6.609 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_20=1.546, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H2=-1.156, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Date: Thu, 02 Feb 2017 17:53:22 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1486086802; bh=p6DO59EDtV4bpIaa2utZKQIWD4dGT8O44xNW/PyX8Wc=; h=From:Reply-To:To:Cc:Subject:List-ID:List-Archive:List-Post: List-Unsubscribe:From; b=vYAahXu99lsTVtVuvjbNa9RJulVO2DYXahIGTj1LJzvl/NxB8HcOpEvigh7zshbF6 tfFf/cq1sNcFpbXb/+B0a/eQdv0wsYzgqfQ9lN4ZNSVrq0tQUl9e7t90UTmaVix7Mt EBHobkPj/56AskLSn6V8EgEnuZvyeA/fWi5cKU3M= To: httpwg/http-extensions Subject: [httpwg/http-extensions] Editorial suggestions (#286) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_5893e29245aa4_5bef3fe422d3713843594d"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 03 Feb 2017 01:53:25 -0000 ----==_mimepart_5893e29245aa4_5bef3fe422d3713843594d Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/issues/286 ----==_mimepart_5893e29245aa4_5bef3fe422d3713843594d Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_5893e29245aa4_5bef3fe422d3713843594d-- From nobody Thu Feb 2 17:55:24 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -3.6 X-Spam-Level: X-Spam-Status: No, score=-3.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_24=1.618, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-3.199, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=github.com; h=from:reply-to:to:cc:in-reply-to:references:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=1xNdOR5yg9eDj96UUL6/dM37Dsg=; b=SE3Z1lBJty/eMgeO 0MSosvAYz0paSlMX7kRkPPvIkL1oP2tHHNYDOfgjR0CFjATAWhIfQYje6S9Iq5Xl 4tNjM9Us8xFngXbUkjCHVQbBB14MKuEgfoIhisxuy3X0PFIyKSccK9SY5PkjIxD8 GI9rji4uWegYa9x002RtE1p78dg= Date: Thu, 02 Feb 2017 17:55:06 -0800 To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] Editorial suggestions (#286) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_5893e2fa86ed2_390b3fd627c8d13c109988"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 03 Feb 2017 01:55:24 -0000 ----==_mimepart_5893e2fa86ed2_390b3fd627c8d13c109988 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Closed #286. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/issues/286#event-947457714 ----==_mimepart_5893e2fa86ed2_390b3fd627c8d13c109988 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

Closed #286.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_5893e2fa86ed2_390b3fd627c8d13c109988-- From nobody Thu Feb 2 18:13:42 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -6.751 X-Spam-Level: X-Spam-Status: No, score=-6.751 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_28=1.404, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H2=-1.156, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Date: Thu, 02 Feb 2017 18:13:39 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1486088019; bh=KHK2/AqF3SLhpev0Ve8en2yTqdo1vtsWgZOwFz5Db7Y=; h=From:Reply-To:To:Cc:Subject:List-ID:List-Archive:List-Post: List-Unsubscribe:From; b=u796ALgWgbwh1g1IHl7H+bZRh7q15a4FsQ0E8SV+xB64XJUrBS1vlRCupnFM6T4bu hJwwX7vMMeb+XfCY4QmyHhwRM4OmAN4E86kt3xezMO+1e1nSyTDubbnotVKOrAln3d qhWgRRO1RfgeNhOtPmN66Y5U9a/pTyKmFJ6NeqUc= To: httpwg/http-extensions Subject: [httpwg/http-extensions] Immutable editorial (#287) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_5893e7532d534_6623fb5551f713466878"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 03 Feb 2017 02:13:41 -0000 ----==_mimepart_5893e7532d534_6623fb5551f713466878 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Editorial stuff, mostly line wrapping and adjusting terminology. Happy to chat through it if you like. You can view, comment on, or merge this pull request online at: https://github.com/httpwg/http-extensions/pull/287 -- Commit Summary -- * Introduction * cc: extesion section * should -> SHOULD, light tweaking -- File Changes -- M draft-ietf-httpbis-immutable.md (153) -- Patch Links -- https://github.com/httpwg/http-extensions/pull/287.patch https://github.com/httpwg/http-extensions/pull/287.diff -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/pull/287 ----==_mimepart_5893e7532d534_6623fb5551f713466878 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

Editorial stuff, mostly line wrapping and adjusting terminology. Happy to chat through it if you like.

You can view, comment on, or merge this pull request online at:

  https://github.com/httpwg/http-extensions/pull/287

Commit Summary

  • Introduction
  • cc: extesion section
  • should -> SHOULD, light tweaking

File Changes

Patch Links:

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_5893e7532d534_6623fb5551f713466878-- From nobody Thu Feb 2 18:17:16 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -6.537 X-Spam-Level: X-Spam-Status: No, score=-6.537 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_24=1.618, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H2=-1.156, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Date: Thu, 02 Feb 2017 18:17:11 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1486088231; bh=herw8f3yMDCRKh1BzHn05JtV7fi2oT3mQrD2Y7qqCps=; h=From:Reply-To:To:Cc:Subject:List-ID:List-Archive:List-Post: List-Unsubscribe:From; b=Q3aST/pSGtHBYv5gUEopUyCqcqrmmKgc69jMD1YiE+UA9yUteWrOBuPvy0hW16RO2 YO4Yg5ifJX4K7E5ZZaj5CZ4MSEFOEtKEM3df+m4luFgPVlebZEvGbq/tZivV4/vfdQ iUXKCUy074R7jwyZ3S0H0qMN7lZLbLdARztIXKc0= To: httpwg/http-extensions Subject: [httpwg/http-extensions] The inverse of immutable (#288) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_5893e827a391b_5703fbd7fbaf140607cd"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 03 Feb 2017 02:17:14 -0000 ----==_mimepart_5893e827a391b_5703fbd7fbaf140607cd Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Chrome currently implements the semantics of `immutable` using a browser heuristic rather than an explicit signal from the server. if we define a complimentary CC extension with the inverse semantics of `immutable` -- i.e., roughly, "always refresh this when the user hits reload" -- it would allow Chrome to continue using a heuristic, but override it with an explicit signal from the server when the server cares about it. If we do that, I think the CC extension name should be short (e.g., one or two characters). -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/issues/288 ----==_mimepart_5893e827a391b_5703fbd7fbaf140607cd Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

Chrome currently implements the semantics of immutable using a browser heuristic rather than an explicit signal from the server.

if we define a complimentary CC extension with the inverse semantics of immutable -- i.e., roughly, "always refresh this when the user hits reload" -- it would allow Chrome to continue using a heuristic, but override it with an explicit signal from the server when the server cares about it.

If we do that, I think the CC extension name should be short (e.g., one or two characters).

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_5893e827a391b_5703fbd7fbaf140607cd-- From nobody Thu Feb 2 18:20:41 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -6.751 X-Spam-Level: X-Spam-Status: No, score=-6.751 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_28=1.404, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H2=-1.156, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Date: Thu, 02 Feb 2017 18:20:38 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1486088438; bh=zdE2G5gWnA5/bH+2vv4WuRUVk8iMcTY91yIIN0etc64=; h=From:Reply-To:To:Cc:Subject:List-ID:List-Archive:List-Post: List-Unsubscribe:From; b=wzGwmUVnVl/eiM8lx/v4GDH8FJCQXdT+BH7KGjpHFkDglZBcrhPYy39grhLDxUC0B SkH+wpMzY46P19bRtbH/3vup0ZjziBFK7AACBssFHATGCnpb04acu+Lrh3+DMvN6dC yuBx92rBZznpmr7bGeo/VJhFPWeYGLCemqn8mPGg= To: httpwg/http-extensions Subject: [httpwg/http-extensions] immutable definition (#289) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_5893e8f6c1303_58f3fbd7fbaf140101446"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 03 Feb 2017 02:20:41 -0000 ----==_mimepart_5893e8f6c1303_58f3fbd7fbaf140101446 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit The definition of `immutable`s semantics are a bit weird: > When present in an HTTP response, the `immutable` Cache-Control extension indicates that the origin server MUST NOT update the representation of that resource during the freshness lifetime of the response. I think it should be defined in terms of client operation, rather than server operation. E.g., > When present in an HTTP response, the `immutable` Cache-Control extension indicates that clients SHOULD NOT issue a conditional request during the response's freshness lifetime (e.g., upon a "reload"), unless explicitly overridden by the user (e.g., a "force reload"). -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/issues/289 ----==_mimepart_5893e8f6c1303_58f3fbd7fbaf140101446 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

The definition of immutables semantics are a bit weird:

When present in an HTTP response, the immutable Cache-Control extension indicates that the origin server MUST NOT update the representation of that resource during the freshness lifetime of the response.

I think it should be defined in terms of client operation, rather than server operation. E.g.,

When present in an HTTP response, the immutable Cache-Control extension indicates that clients SHOULD NOT issue a conditional request during the response's freshness lifetime (e.g., upon a "reload"), unless explicitly overridden by the user (e.g., a "force reload").

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_5893e8f6c1303_58f3fbd7fbaf140101446-- From nobody Thu Feb 2 18:22:24 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_24=1.618, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-3.199, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=github.com; h=from:reply-to:to:cc:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=ZJgZjrIvRORVGBnoLDPFlLWTkOk=; b=sORExltEUZzZcar9 Bw3RG6j39/zMcf325TP0g2InhR8gMRkQxQJoybnJPjk1aeVxfg4P1rYdeeb2wS18 a8phbojawCv7q0WfWx5WJWecREMT3ytPc6ccmkbGggIWoapEApvidxsOX8j2YKtC s1/01E6Uwd1tHap3AUQ1dI7cSSQ= Date: Thu, 02 Feb 2017 18:22:19 -0800 To: httpwg/http-extensions Subject: [httpwg/http-extensions] About Intermediaries (#290) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_5893e95b6e7a0_7af53fef036d7130159927"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 03 Feb 2017 02:22:23 -0000 ----==_mimepart_5893e95b6e7a0_7af53fef036d7130159927 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit > An immutable response has the same semantic meaning for proxy clients as it does for User-Agent based clients and they therefore MAY also presume a conditional revalidation for a response marked immutable would return 304. A proxy client who uses immutable to anticipate a 304 response may choose whether to reply with a 304 or 200 to its requesting client. Parse error :) What are you trying to do? -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/issues/290 ----==_mimepart_5893e95b6e7a0_7af53fef036d7130159927 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

An immutable response has the same semantic meaning for proxy clients as it does for User-Agent based clients and they therefore MAY also presume a conditional revalidation for a response marked immutable would return 304. A proxy client who uses immutable to anticipate a 304 response may choose whether to reply with a 304 or 200 to its requesting client.

Parse error :) What are you trying to do?

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_5893e95b6e7a0_7af53fef036d7130159927-- From nobody Thu Feb 2 19:08:24 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -4.808 X-Spam-Level: X-Spam-Status: No, score=-4.808 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_20=1.546, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-1.156, RP_MATCHES_RCVD=-3.199, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=github.com; h=from:reply-to:to:cc:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=2eOUp5JVFmfXNmcH/AkpTB8W3GM=; b=DmRASsp9fJbkR9lL 1NwLvGdT8lvLG2QqCF0GP5xkZuCxjD6b1wFq4ymihawcG4wlORbs/QUscoQ59hYe loj2w+LAqDGZc8aS9hWgAcUE+r/QUWw3nmvQb5E7qfNC+CawSo2xNFwMWXHY6ijN ojfiS0eFOq5yczamtPaIjGs3x7A= Date: Thu, 02 Feb 2017 19:08:19 -0800 To: httpwg/http-extensions Subject: [httpwg/http-extensions] Persistence (#291) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_5893f4238e935_6be23ff74237113429516c"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 03 Feb 2017 03:08:23 -0000 ----==_mimepart_5893f4238e935_6be23ff74237113429516c Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Dare we specify that clients MAY/SHOULD persist origin information for a given endpoint beyond the lifetime of the connection? -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/issues/291 ----==_mimepart_5893f4238e935_6be23ff74237113429516c Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

Dare we specify that clients MAY/SHOULD persist origin information for a given endpoint beyond the lifetime of the connection?

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_5893f4238e935_6be23ff74237113429516c-- From nobody Fri Feb 3 08:10:05 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -8.654 X-Spam-Level: X-Spam-Status: No, score=-8.654 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H2=-1.156, RP_MATCHES_RCVD=-3.199, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=github.com; h=from:reply-to:to:cc:in-reply-to:references:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=xn7Vwxrn2rtUobcYw85Ug+Qm/7U=; b=Lg0F9TJulAUoSFhr F5iXcIyg4aHIgiuK+gDys7ZrrSKnZyBfU8mflN7QHd8CtziP/cug7VLWJSoS9YrD YI7X4k2SgiAk+fiGhjx9quH7gO1BVPT7zssKPOnDQjD5mcx9aI2QmrKH3psLRt0A 1ah62yWqQDdEYlMyF7Usb5o0Fgo= Date: Fri, 03 Feb 2017 08:09:58 -0800 To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] DNS relaxation, smaller initial Origin Set (#285) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_5894ab56a5090_76b13fe1e92111401774d7"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 03 Feb 2017 16:10:03 -0000 ----==_mimepart_5894ab56a5090_76b13fe1e92111401774d7 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit mcmanus commented on this pull request. this is indeed looking good > @@ -58,6 +58,11 @@ Using a status code in this manner allows clients to recover from misdirected re penalty of adding latency. To address that, this specification defines a new HTTP/2 frame type, "ORIGIN", to allow servers to indicate what origins a connection is usable for. +Additionally, experience has shown that HTTP/2's requirement to establish server authority using +both DNS and the server's certificate is onerous. This specification relaxes the requirement to +check DNS when the ORIGIN frame is in use. + + nit extra newline > -REMOVE (0x2): -: Indicates that the origin(s) carried in the payload must be removed from the Origin Set, if present; if not present, it/they have no effect. +This specification does not define any flags for the ORIGIN frame, but future updates might use +them to change its semantics. The first four flags (0x1, 0x2, 0x4 and 0x8) are reserved for this is a whole new, albeit interesting!, way of versioning. is this the place to break that ground? > -REMOVE (0x2): -: Indicates that the origin(s) carried in the payload must be removed from the Origin Set, if present; if not present, it/they have no effect. +This specification does not define any flags for the ORIGIN frame, but future updates might use +them to change its semantics. The first four flags (0x1, 0x2, 0x4 and 0x8) are reserved for +backwards-incompatible changes, and therefore when any of them are set, the ORIGIN frame containing +them MUST be ignored by clients conforming to this specification. The remaining flags are reserved +for backwards-compatible changes, and do not affect processing by clients conformant to this +specification. + +The ORIGIN frame is processed hop-by-hop. An intermediary MUST NOT forward ORIGIN frames. Clients clarifying suggestion: The ORIGIN frame describes a property of the connection, and therefore is processed hop-by-hop. > +specification. + +The ORIGIN frame is processed hop-by-hop. An intermediary MUST NOT forward ORIGIN frames. Clients +configured to use a proxy MUST ignore any ORIGIN frames received from it. + +Each ASCII-Origin field in the frame's payload MUST be parsed as an ASCII serialisation of an +origin ({{!RFC6454}}, Section 6.2). If parsing fails, the field MUST be ignored. + +Senders should note that, as per {{!RFC6454}} Section 4, the values in an ORIGIN header need to be +case-normalised before serialisation. + +Once parsed, the value MUST have: + +* a scheme of "https", +* a host that is reflected in a `subjectAltName` of the connection's TLS certificate (using the wildcard rules defined in {{!RFC2818}}, Section 3.1), and +* a port that reflects the connection's remote port on the client. hmm. how does this interact with Alt-Svc? Seems that you could be connected to a port number different than the origin port number (thanks to Alt-Svc) and still want to use origin frames. > -The ORIGIN frame allows the server to modify the Origin Set. In particular: + - Scheme: "https" + - Host: the value sent in Server Name Indication ({{!RFC6066}} Section 3), converted to lower case + - Port: the local port of the connection on the server alt-svc concern applies here too wrt port > @@ -58,6 +58,11 @@ Using a status code in this manner allows clients to recover from misdirected re penalty of adding latency. To address that, this specification defines a new HTTP/2 frame type, "ORIGIN", to allow servers to indicate what origins a connection is usable for. +Additionally, experience has shown that HTTP/2's requirement to establish server authority using in discussions on this there are a couple of other motivators that may (or may not!) be worth including as introductory text.. one is simply that it can save a dns lookup by effectively inlining the result and the other is that dns is often a privacy leak that can be avoided by not making the lookup -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/pull/285#pullrequestreview-20027455 ----==_mimepart_5894ab56a5090_76b13fe1e92111401774d7 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

@mcmanus commented on this pull request.

this is indeed looking good

In draft-ietf-httpbis-origin-frame.md:

> @@ -58,6 +58,11 @@ Using a status code in this manner allows clients to recover from misdirected re
 penalty of adding latency. To address that, this specification defines a new HTTP/2 frame type,
 "ORIGIN", to allow servers to indicate what origins a connection is usable for.
 
+Additionally, experience has shown that HTTP/2's requirement to establish server authority using
+both DNS and the server's certificate is onerous. This specification relaxes the requirement to
+check DNS when the ORIGIN frame is in use.
+
+

nit extra newline

In draft-ietf-httpbis-origin-frame.md:

>  
-REMOVE (0x2): 
-: Indicates that the origin(s) carried in the payload must be removed from the Origin Set, if present; if not present, it/they have no effect.
+This specification does not define any flags for the ORIGIN frame, but future updates might use
+them to change its semantics. The first four flags (0x1, 0x2, 0x4 and 0x8) are reserved for

this is a whole new, albeit interesting!, way of versioning. is this the place to break that ground?

In draft-ietf-httpbis-origin-frame.md:

>  
-REMOVE (0x2): 
-: Indicates that the origin(s) carried in the payload must be removed from the Origin Set, if present; if not present, it/they have no effect.
+This specification does not define any flags for the ORIGIN frame, but future updates might use
+them to change its semantics. The first four flags (0x1, 0x2, 0x4 and 0x8) are reserved for
+backwards-incompatible changes, and therefore when any of them are set, the ORIGIN frame containing
+them MUST be ignored by clients conforming to this specification. The remaining flags are reserved
+for backwards-compatible changes, and do not affect processing by clients conformant to this
+specification.
+
+The ORIGIN frame is processed hop-by-hop. An intermediary MUST NOT forward ORIGIN frames. Clients

clarifying suggestion: The ORIGIN frame describes a property of the connection, and therefore is processed hop-by-hop.

In draft-ietf-httpbis-origin-frame.md:

> +specification.
+
+The ORIGIN frame is processed hop-by-hop. An intermediary MUST NOT forward ORIGIN frames. Clients
+configured to use a proxy MUST ignore any ORIGIN frames received from it.
+
+Each ASCII-Origin field in the frame's payload MUST be parsed as an ASCII serialisation of an
+origin ({{!RFC6454}}, Section 6.2). If parsing fails, the field MUST be ignored.
+
+Senders should note that, as per {{!RFC6454}} Section 4, the values in an ORIGIN header need to be
+case-normalised before serialisation.
+
+Once parsed, the value MUST have:
+
+* a scheme of "https", 
+* a host that is reflected in a `subjectAltName` of the connection's TLS certificate (using the wildcard rules defined in {{!RFC2818}}, Section 3.1), and 
+* a port that reflects the connection's remote port on the client.

hmm. how does this interact with Alt-Svc? Seems that you could be connected to a port number different than the origin port number (thanks to Alt-Svc) and still want to use origin frames.

In draft-ietf-httpbis-origin-frame.md:

>  
-The ORIGIN frame allows the server to modify the Origin Set. In particular:
+  - Scheme: "https"
+  - Host: the value sent in Server Name Indication ({{!RFC6066}} Section 3), converted to lower case
+  - Port: the local port of the connection on the server

alt-svc concern applies here too wrt port

In draft-ietf-httpbis-origin-frame.md:

> @@ -58,6 +58,11 @@ Using a status code in this manner allows clients to recover from misdirected re
 penalty of adding latency. To address that, this specification defines a new HTTP/2 frame type,
 "ORIGIN", to allow servers to indicate what origins a connection is usable for.
 
+Additionally, experience has shown that HTTP/2's requirement to establish server authority using

in discussions on this there are a couple of other motivators that may (or may not!) be worth including as introductory text.. one is simply that it can save a dns lookup by effectively inlining the result and the other is that dns is often a privacy leak that can be avoided by not making the lookup

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_5894ab56a5090_76b13fe1e92111401774d7-- From nobody Fri Feb 3 11:34:15 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -8.654 X-Spam-Level: X-Spam-Status: No, score=-8.654 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H2=-1.156, RP_MATCHES_RCVD=-3.199, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=github.com; h=from:reply-to:to:cc:in-reply-to:references:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=3hmhhMa2VThWSz1IkwshxVO58QA=; b=jXjl6ttPRNfYOvhN nOg0M5SoGX0vnqoqN+Ioa2a4CgTN/PCt/KnNEsEacq7eST4ZZhRtnaKKR83vpa7w sQJFExKDT3aObgIcx1F5/AMyo6gLjDpdoHLV0FdjWN+slFTykQxBfWRFvtuJIubn WiwkcBhkprmhSet3vxrRzHUfxFw= Date: Fri, 03 Feb 2017 11:33:32 -0800 To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] DNS relaxation, smaller initial Origin Set (#285) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_5894db0c173c3_47483fd389b9313c2006b7"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 03 Feb 2017 19:34:14 -0000 ----==_mimepart_5894db0c173c3_47483fd389b9313c2006b7 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit deweerdt commented on this pull request. minor nits > +-------------------------------+-------------------------------+ ~~~~ The ORIGIN frame's payload contains the following fields, sets of which may be repeated within the frame to indicate multiple origins: Origin-Len: -: An unsigned, 16-bit integer indicating the length, in octets, of the Origin field. +: An unsigned, 16-bit integer indicating the length, in octets, of the ASCII-Origin field. Should this mention network ordering? > + +1. If the client is configured to use a proxy for the connection, ignore the frame and stop processing. +2. If the connection is not identified with the "h2" protocol identifier or another protocol that has explicitly opted into this specification, ignore the frame and stop processing. +3. If the frame occurs upon any stream except stream 0, ignore the frame and stop processing. +4. If any of the flags 0x1, 0x2, 0x4 or 0x8 are set, ignore the frame and stop processing. +5. If no previous ORIGIN frame on the connection has reached this step, initialise the Origin Set as per {{set}}. +6. For each Origin field `origin_raw` in the frame payload: + 1. Parse `origin_raw` as an ASCII serialization of an origin ({{!RFC6454}}, Section 6.2) and let the result be `parsed_origin`. If parsing fails, skip to the next `origin_raw`. + 2. If the `scheme` of `parsed_origin` is not "https", skip to the next `origin_raw`. + 3. If the certificate presented by the server is not valid for the `host` of `parsed_origin` (see below), skip to the next `origin_raw`. + 4. If the `port` of `parsed_origin` does not match the connection's remote port, skip to the next `origin_raw`. + 5. Add `parsed_origin` to the Origin Set. + +The certificate presented by the server is valid for a host if it passes the checks that the client +would perform when forming a new TLS connection to the origin. This includes verifying that the +host matches a `dNSName` value from the certificate `subjectAltName` field (using the wildcard rules typo: s/sNSName/DNSName/ > +6. For each Origin field `origin_raw` in the frame payload: + 1. Parse `origin_raw` as an ASCII serialization of an origin ({{!RFC6454}}, Section 6.2) and let the result be `parsed_origin`. If parsing fails, skip to the next `origin_raw`. + 2. If the `scheme` of `parsed_origin` is not "https", skip to the next `origin_raw`. + 3. If the certificate presented by the server is not valid for the `host` of `parsed_origin` (see below), skip to the next `origin_raw`. + 4. If the `port` of `parsed_origin` does not match the connection's remote port, skip to the next `origin_raw`. + 5. Add `parsed_origin` to the Origin Set. + +The certificate presented by the server is valid for a host if it passes the checks that the client +would perform when forming a new TLS connection to the origin. This includes verifying that the +host matches a `dNSName` value from the certificate `subjectAltName` field (using the wildcard rules +defined in {{!RFC2818}}). + + +# Operational Considerations for Servers {#server-ops} + +The ORIGIN frame allows a server to indicate what for origins a given connection ought be used. s/to indicate what for origins/to indicate for which origins/ -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/pull/285#pullrequestreview-20085980 ----==_mimepart_5894db0c173c3_47483fd389b9313c2006b7 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

@deweerdt commented on this pull request.

minor nits

In draft-ietf-httpbis-origin-frame.md:

>  +-------------------------------+-------------------------------+
 ~~~~
 
 The ORIGIN frame's payload contains the following fields, sets of which may be repeated within the
 frame to indicate multiple origins:
 
 Origin-Len:
-: An unsigned, 16-bit integer indicating the length, in octets, of the Origin field.
+: An unsigned, 16-bit integer indicating the length, in octets, of the ASCII-Origin field.

Should this mention network ordering?

In draft-ietf-httpbis-origin-frame.md:

> +
+1. If the client is configured to use a proxy for the connection, ignore the frame and stop processing.
+2. If the connection is not identified with the "h2" protocol identifier or another protocol that has explicitly opted into this specification, ignore the frame and stop processing.
+3. If the frame occurs upon any stream except stream 0, ignore the frame and stop processing.
+4. If any of the flags 0x1, 0x2, 0x4 or 0x8 are set, ignore the frame and stop processing.
+5. If no previous ORIGIN frame on the connection has reached this step, initialise the Origin Set as per {{set}}.
+6. For each Origin field `origin_raw` in the frame payload:
+   1. Parse `origin_raw` as an ASCII serialization of an origin ({{!RFC6454}}, Section 6.2) and let the result be `parsed_origin`. If parsing fails, skip to the next `origin_raw`.
+   2. If the `scheme` of `parsed_origin` is not "https", skip to the next `origin_raw`.
+   3. If the certificate presented by the server is not valid for the `host` of `parsed_origin` (see below), skip to the next `origin_raw`.
+   4. If the `port` of `parsed_origin` does not match the connection's remote port, skip to the next `origin_raw`.
+   5. Add `parsed_origin` to the Origin Set.
+
+The certificate presented by the server is valid for a host if it passes the checks that the client
+would perform when forming a new TLS connection to the origin. This includes verifying that the
+host matches a `dNSName` value from the certificate `subjectAltName` field (using the wildcard rules

typo: s/sNSName/DNSName/

In draft-ietf-httpbis-origin-frame.md:

> +6. For each Origin field `origin_raw` in the frame payload:
+   1. Parse `origin_raw` as an ASCII serialization of an origin ({{!RFC6454}}, Section 6.2) and let the result be `parsed_origin`. If parsing fails, skip to the next `origin_raw`.
+   2. If the `scheme` of `parsed_origin` is not "https", skip to the next `origin_raw`.
+   3. If the certificate presented by the server is not valid for the `host` of `parsed_origin` (see below), skip to the next `origin_raw`.
+   4. If the `port` of `parsed_origin` does not match the connection's remote port, skip to the next `origin_raw`.
+   5. Add `parsed_origin` to the Origin Set.
+
+The certificate presented by the server is valid for a host if it passes the checks that the client
+would perform when forming a new TLS connection to the origin. This includes verifying that the
+host matches a `dNSName` value from the certificate `subjectAltName` field (using the wildcard rules
+defined in {{!RFC2818}}).
+
+
+# Operational Considerations for Servers {#server-ops}
+
+The ORIGIN frame allows a server to indicate what for origins a given connection ought be used.

s/to indicate what for origins/to indicate for which origins/

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_5894db0c173c3_47483fd389b9313c2006b7-- From nobody Fri Feb 3 16:25:51 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -3.814 X-Spam-Level: X-Spam-Status: No, score=-3.814 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_28=1.404, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-3.199, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=github.com; h=from:reply-to:to:cc:in-reply-to:references:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=LLaruUTfnkD/Not9T0UgcqSnoc8=; b=eiv1OoCOOWYfmGt+ ZrcO4FZoTkK5rkccU/KkgA9lvhYbMT8t80SzWgVz2nHnEcwI4ckXpPFm1e1e7kyu f5sWCOb4/SyQa9CpZ8nvHb+wiUjyatmE0YXKj/5CUNRkiaUoHJ+XEawy6uRK3Y3z lO86I5ctXpki7L0OFIL/vX2lCow= Date: Fri, 03 Feb 2017 16:25:45 -0800 To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] DNS relaxation, smaller initial Origin Set (#285) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_58951f897ce55_72cb3fc6af73313c1054f2"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 04 Feb 2017 00:25:49 -0000 ----==_mimepart_58951f897ce55_72cb3fc6af73313c1054f2 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit mnot commented on this pull request. > -REMOVE (0x2): -: Indicates that the origin(s) carried in the payload must be removed from the Origin Set, if present; if not present, it/they have no effect. +This specification does not define any flags for the ORIGIN frame, but future updates might use +them to change its semantics. The first four flags (0x1, 0x2, 0x4 and 0x8) are reserved for Well, it has to be somewhere. I did it here because there seem to be some cases that require a breaking change (e.g., if we want to include a DELETE or CLEAR flag down the road), and some that don't (e.g., wildcard support). Happy to take it out (there are always more ways to do it), but it seemed mostly harmless to try it out here. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/pull/285 ----==_mimepart_58951f897ce55_72cb3fc6af73313c1054f2 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

@mnot commented on this pull request.

In draft-ietf-httpbis-origin-frame.md:

>  
-REMOVE (0x2): 
-: Indicates that the origin(s) carried in the payload must be removed from the Origin Set, if present; if not present, it/they have no effect.
+This specification does not define any flags for the ORIGIN frame, but future updates might use
+them to change its semantics. The first four flags (0x1, 0x2, 0x4 and 0x8) are reserved for

Well, it has to be somewhere. I did it here because there seem to be some cases that require a breaking change (e.g., if we want to include a DELETE or CLEAR flag down the road), and some that don't (e.g., wildcard support).

Happy to take it out (there are always more ways to do it), but it seemed mostly harmless to try it out here.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_58951f897ce55_72cb3fc6af73313c1054f2-- From nobody Fri Feb 3 16:30:36 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -6.537 X-Spam-Level: X-Spam-Status: No, score=-6.537 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_24=1.618, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H2=-1.156, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Date: Fri, 03 Feb 2017 16:30:32 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1486168232; bh=1uwI8TllqzGxb1VBzycsMNvyJ+NdBOf5LpGChP+gXBI=; h=From:Reply-To:To:Cc:In-Reply-To:References:Subject:List-ID: List-Archive:List-Post:List-Unsubscribe:From; b=SBcOOQzOzQKMhgScJKgGytUXw9yIM61wrRw6Y5Dkjl9LXL/Dy0FFxw3Mi58YcgA8L KL6VcgGsrfiBuHK1/IE2X7n+emT87e+vH2+7BdTV6DLLgjIUm26kHFbqN6OKdZh/pk vBc92f+xSnQ2q+tzj62C5R5d3bFLll1oAfzNcmAY= To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] DNS relaxation, smaller initial Origin Set (#285) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_589520a851090_3f33fb8035911405084b"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 04 Feb 2017 00:30:35 -0000 ----==_mimepart_589520a851090_3f33fb8035911405084b Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit mnot commented on this pull request. > @@ -58,6 +58,11 @@ Using a status code in this manner allows clients to recover from misdirected re penalty of adding latency. To address that, this specification defines a new HTTP/2 frame type, "ORIGIN", to allow servers to indicate what origins a connection is usable for. +Additionally, experience has shown that HTTP/2's requirement to establish server authority using already fixed -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/pull/285 ----==_mimepart_589520a851090_3f33fb8035911405084b Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

@mnot commented on this pull request.

In draft-ietf-httpbis-origin-frame.md:

> @@ -58,6 +58,11 @@ Using a status code in this manner allows clients to recover from misdirected re
 penalty of adding latency. To address that, this specification defines a new HTTP/2 frame type,
 "ORIGIN", to allow servers to indicate what origins a connection is usable for.
 
+Additionally, experience has shown that HTTP/2's requirement to establish server authority using

already fixed

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_589520a851090_3f33fb8035911405084b-- From nobody Fri Feb 3 16:30:52 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -3.814 X-Spam-Level: X-Spam-Status: No, score=-3.814 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_28=1.404, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-3.199, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=github.com; h=from:reply-to:to:cc:in-reply-to:references:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=Wtq46rFCQb7VyW+1F+iY2U77Mb8=; b=NoaMW/qyKxLpfS/H xaoheTi8bRAPyOW64oWtXaSbmFnC9iyN2Im0/QVEOAtiKKFApjRU2hRKHPD5GM95 KdEztKJ75H+XDbP1Bp5cFFMq0Ns/5ESyu5n/PkpY8WUsDvOjQhuwgGckNKuMP1Sd hXgYiofOkHHKSs41uLGdv5e13hg= Date: Fri, 03 Feb 2017 16:30:38 -0800 To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] DNS relaxation, smaller initial Origin Set (#285) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_589520ae3b79e_27fa3fc3ae18313c1107e8"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 04 Feb 2017 00:30:50 -0000 ----==_mimepart_589520ae3b79e_27fa3fc3ae18313c1107e8 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit mnot commented on this pull request. > @@ -58,6 +58,11 @@ Using a status code in this manner allows clients to recover from misdirected re penalty of adding latency. To address that, this specification defines a new HTTP/2 frame type, "ORIGIN", to allow servers to indicate what origins a connection is usable for. +Additionally, experience has shown that HTTP/2's requirement to establish server authority using +both DNS and the server's certificate is onerous. This specification relaxes the requirement to +check DNS when the ORIGIN frame is in use. + + already fixed -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/pull/285 ----==_mimepart_589520ae3b79e_27fa3fc3ae18313c1107e8 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

@mnot commented on this pull request.

In draft-ietf-httpbis-origin-frame.md:

> @@ -58,6 +58,11 @@ Using a status code in this manner allows clients to recover from misdirected re
 penalty of adding latency. To address that, this specification defines a new HTTP/2 frame type,
 "ORIGIN", to allow servers to indicate what origins a connection is usable for.
 
+Additionally, experience has shown that HTTP/2's requirement to establish server authority using
+both DNS and the server's certificate is onerous. This specification relaxes the requirement to
+check DNS when the ORIGIN frame is in use.
+
+

already fixed

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_589520ae3b79e_27fa3fc3ae18313c1107e8-- From nobody Fri Feb 3 16:33:14 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -8.155 X-Spam-Level: X-Spam-Status: No, score=-8.155 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H2=-1.156, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Date: Fri, 03 Feb 2017 16:33:11 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1486168391; bh=GDt0hOy7qNcENmeVp6/AvDkvKIqKUzoAo4EmolSOxP0=; h=From:Reply-To:To:Cc:In-Reply-To:References:Subject:List-ID: List-Archive:List-Post:List-Unsubscribe:From; b=pSrf/Q2RkFYujPAhqnoZ8R9sqsr8ZytVKITz+EzG24bllz6TSSSF23Q9e8scnCCG/ h5hyETyuh37zqWBFEPhjGzKuCIJu/5xXCHCaNYNYyS7mVh6USxffxX6oONPiwUFfXS u9QgLeTMZHa0uAH+6kcABHAAM7Ru8k0bXqQgJT4U= To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] DNS relaxation, smaller initial Origin Set (#285) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_5895214716477_2b0d3fce06c5d140662c"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 04 Feb 2017 00:33:14 -0000 ----==_mimepart_5895214716477_2b0d3fce06c5d140662c Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit mnot commented on this pull request. > + +1. If the client is configured to use a proxy for the connection, ignore the frame and stop processing. +2. If the connection is not identified with the "h2" protocol identifier or another protocol that has explicitly opted into this specification, ignore the frame and stop processing. +3. If the frame occurs upon any stream except stream 0, ignore the frame and stop processing. +4. If any of the flags 0x1, 0x2, 0x4 or 0x8 are set, ignore the frame and stop processing. +5. If no previous ORIGIN frame on the connection has reached this step, initialise the Origin Set as per {{set}}. +6. For each Origin field `origin_raw` in the frame payload: + 1. Parse `origin_raw` as an ASCII serialization of an origin ({{!RFC6454}}, Section 6.2) and let the result be `parsed_origin`. If parsing fails, skip to the next `origin_raw`. + 2. If the `scheme` of `parsed_origin` is not "https", skip to the next `origin_raw`. + 3. If the certificate presented by the server is not valid for the `host` of `parsed_origin` (see below), skip to the next `origin_raw`. + 4. If the `port` of `parsed_origin` does not match the connection's remote port, skip to the next `origin_raw`. + 5. Add `parsed_origin` to the Origin Set. + +The certificate presented by the server is valid for a host if it passes the checks that the client +would perform when forming a new TLS connection to the origin. This includes verifying that the +host matches a `dNSName` value from the certificate `subjectAltName` field (using the wildcard rules Is correct; see https://tools.ietf.org/html/rfc5280#section-4.2.1.6 (but will add a ref) -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/pull/285 ----==_mimepart_5895214716477_2b0d3fce06c5d140662c Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

@mnot commented on this pull request.

In draft-ietf-httpbis-origin-frame.md:

> +
+1. If the client is configured to use a proxy for the connection, ignore the frame and stop processing.
+2. If the connection is not identified with the "h2" protocol identifier or another protocol that has explicitly opted into this specification, ignore the frame and stop processing.
+3. If the frame occurs upon any stream except stream 0, ignore the frame and stop processing.
+4. If any of the flags 0x1, 0x2, 0x4 or 0x8 are set, ignore the frame and stop processing.
+5. If no previous ORIGIN frame on the connection has reached this step, initialise the Origin Set as per {{set}}.
+6. For each Origin field `origin_raw` in the frame payload:
+   1. Parse `origin_raw` as an ASCII serialization of an origin ({{!RFC6454}}, Section 6.2) and let the result be `parsed_origin`. If parsing fails, skip to the next `origin_raw`.
+   2. If the `scheme` of `parsed_origin` is not "https", skip to the next `origin_raw`.
+   3. If the certificate presented by the server is not valid for the `host` of `parsed_origin` (see below), skip to the next `origin_raw`.
+   4. If the `port` of `parsed_origin` does not match the connection's remote port, skip to the next `origin_raw`.
+   5. Add `parsed_origin` to the Origin Set.
+
+The certificate presented by the server is valid for a host if it passes the checks that the client
+would perform when forming a new TLS connection to the origin. This includes verifying that the
+host matches a `dNSName` value from the certificate `subjectAltName` field (using the wildcard rules

Is correct; see https://tools.ietf.org/html/rfc5280#section-4.2.1.6 (but will add a ref)

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_5895214716477_2b0d3fce06c5d140662c-- From nobody Fri Feb 3 16:35:17 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -6.537 X-Spam-Level: X-Spam-Status: No, score=-6.537 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_24=1.618, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H2=-1.156, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Date: Fri, 03 Feb 2017 16:27:14 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1486168034; bh=OshnmPENl3gJY9k28D57gfq8PbZJGSlvSWCV37J1sss=; h=From:Reply-To:To:Cc:In-Reply-To:References:Subject:List-ID: List-Archive:List-Post:List-Unsubscribe:From; b=tGJRuB+jqd9o49QjPyfMuHvU62JIT8Xh9Z6ZEsUL4MgxEAuZC7mxUZP4zPlDz/l9F 4E085swX+B2mmJI7klKSOTYK4xOzJqn+pmH6/O0Ljntg5NmnY5oyQ6DaXrriw+f93Q 39DCnfBaqc9AM64xgMJbwzg8JtR0mDUk7CrXMzrY= To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] DNS relaxation, smaller initial Origin Set (#285) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_58951fe25242c_35423fca7d5ef13c203d4"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 04 Feb 2017 00:35:16 -0000 ----==_mimepart_58951fe25242c_35423fca7d5ef13c203d4 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit mnot commented on this pull request. > +-------------------------------+-------------------------------+ ~~~~ The ORIGIN frame's payload contains the following fields, sets of which may be repeated within the frame to indicate multiple origins: Origin-Len: -: An unsigned, 16-bit integer indicating the length, in octets, of the Origin field. +: An unsigned, 16-bit integer indicating the length, in octets, of the ASCII-Origin field. Convention is not to in new frame types, since H2 defines it. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/pull/285 ----==_mimepart_58951fe25242c_35423fca7d5ef13c203d4 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

@mnot commented on this pull request.

In draft-ietf-httpbis-origin-frame.md:

>  +-------------------------------+-------------------------------+
 ~~~~
 
 The ORIGIN frame's payload contains the following fields, sets of which may be repeated within the
 frame to indicate multiple origins:
 
 Origin-Len:
-: An unsigned, 16-bit integer indicating the length, in octets, of the Origin field.
+: An unsigned, 16-bit integer indicating the length, in octets, of the ASCII-Origin field.

Convention is not to in new frame types, since H2 defines it.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_58951fe25242c_35423fca7d5ef13c203d4-- From nobody Fri Feb 3 16:36:24 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -7.036 X-Spam-Level: X-Spam-Status: No, score=-7.036 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_24=1.618, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H2=-1.156, RP_MATCHES_RCVD=-3.199, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=github.com; h=from:reply-to:to:cc:in-reply-to:references:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=x0P01SucgD2qZxh1wqK/IAOrmuQ=; b=pz6NXQ1EvMjB/ZhC EgghW1G6kC0g3EhV8lorq/+EP6AU3fc3Se9vZl2+wMRMR2DjavfMsHCCKtIgcC2Y d/+HwBhdbrssN1iF19NBVDpV+YtK21wvKVenSoDAtfBmpmGFh0jyE7i8IhaS5YgG +ILRorReDctdFG1QmC6t2OuYgiQ= Date: Fri, 03 Feb 2017 16:36:18 -0800 To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] DNS relaxation, smaller initial Origin Set (#285) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_58952202cc274_29da3fc3ae18313c197881"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 04 Feb 2017 00:36:23 -0000 ----==_mimepart_58952202cc274_29da3fc3ae18313c197881 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit mnot commented on this pull request. > @@ -58,6 +58,11 @@ Using a status code in this manner allows clients to recover from misdirected re penalty of adding latency. To address that, this specification defines a new HTTP/2 frame type, "ORIGIN", to allow servers to indicate what origins a connection is usable for. +Additionally, experience has shown that HTTP/2's requirement to establish server authority using Done -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/pull/285 ----==_mimepart_58952202cc274_29da3fc3ae18313c197881 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

@mnot commented on this pull request.

In draft-ietf-httpbis-origin-frame.md:

> @@ -58,6 +58,11 @@ Using a status code in this manner allows clients to recover from misdirected re
 penalty of adding latency. To address that, this specification defines a new HTTP/2 frame type,
 "ORIGIN", to allow servers to indicate what origins a connection is usable for.
 
+Additionally, experience has shown that HTTP/2's requirement to establish server authority using

Done

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_58952202cc274_29da3fc3ae18313c197881-- From nobody Fri Feb 3 16:46:07 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -6.751 X-Spam-Level: X-Spam-Status: No, score=-6.751 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_28=1.404, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H2=-1.156, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Date: Fri, 03 Feb 2017 16:46:04 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1486169164; bh=LJidub/4y/DztruLvqxCTh+4mMvNw3w52+r5/ijDhnw=; h=From:Reply-To:To:Cc:In-Reply-To:References:Subject:List-ID: List-Archive:List-Post:List-Unsubscribe:From; b=RsVIpLroHVG0gnmk6AoEydQ3PfVZq9C1Kwpz1dpGMwDzTsm7XRvisRJKLgl6VgDsy 4Z6nXd1nFxH0Af+zZ1PRWxIUfiosj1RlGVilsHQiNHk4IhUxL63X7fj5+cEBn2KLQ/ 3pQG6fHvSgsP2eGkTawhvlS7taUKsxUBFryXONUk= To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] DNS relaxation, smaller initial Origin Set (#285) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_5895244c3bcf_3cc3fb80359114096096"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Push Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 04 Feb 2017 00:46:06 -0000 ----==_mimepart_5895244c3bcf_3cc3fb80359114096096 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit @mnot pushed 4 commits. cc16f7d Patrick's suggestion about hop-by-hop 5a9a667 deweert suggestion 93d2b92 add 5280 ref 213b958 Add motivation -- You are receiving this because you are subscribed to this thread. View it on GitHub: https://github.com/httpwg/http-extensions/pull/285/files/8afa09b580bf52df234522ce8397e67ff8274e76..213b958c421f2077ea86295d3b3ae753bfb04317 ----==_mimepart_5895244c3bcf_3cc3fb80359114096096 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

@mnot pushed 4 commits.

—
You are receiving this because you are subscribed to this thread.
View it on GitHub or mute the thread.

----==_mimepart_5895244c3bcf_3cc3fb80359114096096-- From nobody Fri Feb 3 16:48:25 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -4.514 X-Spam-Level: X-Spam-Status: No, score=-4.514 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_28=1.404, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-3.199, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=github.com; h=from:reply-to:to:cc:in-reply-to:references:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=CkSdbd1UdmQcvRQghYAFMpZ0tAc=; b=Ux3kE68GEs7v1bpL evtugYEjUWcfceqIzYI6g5sUtMGG/JHYiaZmPaBUulKiX+P0qWYAdB424BKd4n1o Dt6KIzsvfXraq8Pf0k+5nBWH8qQ4M08dPOKpe2wGq/TB3h7UVunE9cFJIu+LLCby LjCZW7kv5HvkgImfqKv96zrG3qU= Date: Fri, 03 Feb 2017 16:48:19 -0800 To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] DNS relaxation, smaller initial Origin Set (#285) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_589524d35d047_72cb3fc6af73313c234417"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 04 Feb 2017 00:48:23 -0000 ----==_mimepart_589524d35d047_72cb3fc6af73313c234417 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit mnot commented on this pull request. > +specification. + +The ORIGIN frame is processed hop-by-hop. An intermediary MUST NOT forward ORIGIN frames. Clients +configured to use a proxy MUST ignore any ORIGIN frames received from it. + +Each ASCII-Origin field in the frame's payload MUST be parsed as an ASCII serialisation of an +origin ({{!RFC6454}}, Section 6.2). If parsing fails, the field MUST be ignored. + +Senders should note that, as per {{!RFC6454}} Section 4, the values in an ORIGIN header need to be +case-normalised before serialisation. + +Once parsed, the value MUST have: + +* a scheme of "https", +* a host that is reflected in a `subjectAltName` of the connection's TLS certificate (using the wildcard rules defined in {{!RFC2818}}, Section 3.1), and +* a port that reflects the connection's remote port on the client. Yeah. need to think about how to best specify that. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/pull/285 ----==_mimepart_589524d35d047_72cb3fc6af73313c234417 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

@mnot commented on this pull request.

In draft-ietf-httpbis-origin-frame.md:

> +specification.
+
+The ORIGIN frame is processed hop-by-hop. An intermediary MUST NOT forward ORIGIN frames. Clients
+configured to use a proxy MUST ignore any ORIGIN frames received from it.
+
+Each ASCII-Origin field in the frame's payload MUST be parsed as an ASCII serialisation of an
+origin ({{!RFC6454}}, Section 6.2). If parsing fails, the field MUST be ignored.
+
+Senders should note that, as per {{!RFC6454}} Section 4, the values in an ORIGIN header need to be
+case-normalised before serialisation.
+
+Once parsed, the value MUST have:
+
+* a scheme of "https", 
+* a host that is reflected in a `subjectAltName` of the connection's TLS certificate (using the wildcard rules defined in {{!RFC2818}}, Section 3.1), and 
+* a port that reflects the connection's remote port on the client.

Yeah. need to think about how to best specify that.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_589524d35d047_72cb3fc6af73313c234417-- From nobody Mon Feb 6 16:52:45 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -4.569 X-Spam-Level: X-Spam-Status: No, score=-4.569 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_24=1.618, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H2=-1.887, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=github.com; h=from:reply-to:to:cc:in-reply-to:references:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=Y33MPhdpvbtUwElIfjqMT2bv5MU=; b=CEJQeH04gqlI+r2U LRP1Vf4WbvzvaR7EmoIWiK4+SxFpiaV0rzWLfNvk6LTOPCCmYpbJdnlKGlJFg1B4 MecxY1ApKo+ca57vNqMdAqZcNe9Zf86gv1KZEzXsBQoxnZwR9VVOAh4y3MdG7hNN kvokzx/wh0obmo66mnGL9/FIn0Y= Date: Mon, 06 Feb 2017 16:52:01 -0800 To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] DNS relaxation, smaller initial Origin Set (#285) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_58991a31d3b1c_eb83fc7fe6b51382006ee"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Push Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 07 Feb 2017 00:52:43 -0000 ----==_mimepart_58991a31d3b1c_eb83fc7fe6b51382006ee Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit @mnot pushed 2 commits. 2315727 defer checks on origin to use 8520938 move note about case to server-ops -- You are receiving this because you are subscribed to this thread. View it on GitHub: https://github.com/httpwg/http-extensions/pull/285/files/213b958c421f2077ea86295d3b3ae753bfb04317..85209385ab88ed6d90f2507d47fc2e7865516a6e ----==_mimepart_58991a31d3b1c_eb83fc7fe6b51382006ee Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

@mnot pushed 2 commits.

  • 2315727 defer checks on origin to use
  • 8520938 move note about case to server-ops

—
You are receiving this because you are subscribed to this thread.
View it on GitHub or mute the thread.

----==_mimepart_58991a31d3b1c_eb83fc7fe6b51382006ee-- From nobody Mon Feb 6 16:53:04 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -3.886 X-Spam-Level: X-Spam-Status: No, score=-3.886 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_32=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-1.887, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=github.com; h=from:reply-to:to:cc:in-reply-to:references:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=T0PD52bnAGsqz2Cs/Y3jstA3aCI=; b=bFAFeFfjMtx5xJwM gFL53th4QTKFiOAsesJamqL37l941wGJN4pAmOfugKmX8YPuO/hQj/zxFzttkneS +o4oP/r7GGy1/T/JaRQMfGzeWBJ40KIGo1+D3fpTEtEmooAIooCaFiGe/agiTmBS bC+QFF0QjC++CbUZncHyjXeVExI= Date: Mon, 06 Feb 2017 16:52:50 -0800 To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] DNS relaxation, smaller initial Origin Set (#285) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_58991a628604_65423f8b2b26d1306855a"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 07 Feb 2017 00:52:58 -0000 ----==_mimepart_58991a628604_65423f8b2b26d1306855a Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit mnot commented on this pull request. > +specification. + +The ORIGIN frame is processed hop-by-hop. An intermediary MUST NOT forward ORIGIN frames. Clients +configured to use a proxy MUST ignore any ORIGIN frames received from it. + +Each ASCII-Origin field in the frame's payload MUST be parsed as an ASCII serialisation of an +origin ({{!RFC6454}}, Section 6.2). If parsing fails, the field MUST be ignored. + +Senders should note that, as per {{!RFC6454}} Section 4, the values in an ORIGIN header need to be +case-normalised before serialisation. + +Once parsed, the value MUST have: + +* a scheme of "https", +* a host that is reflected in a `subjectAltName` of the connection's TLS certificate (using the wildcard rules defined in {{!RFC2818}}, Section 3.1), and +* a port that reflects the connection's remote port on the client. @mcmanus see latest commit; I defer the cert checks until use of the origin, and I think that takes care of the concerns here. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/pull/285 ----==_mimepart_58991a628604_65423f8b2b26d1306855a Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

@mnot commented on this pull request.

In draft-ietf-httpbis-origin-frame.md:

> +specification.
+
+The ORIGIN frame is processed hop-by-hop. An intermediary MUST NOT forward ORIGIN frames. Clients
+configured to use a proxy MUST ignore any ORIGIN frames received from it.
+
+Each ASCII-Origin field in the frame's payload MUST be parsed as an ASCII serialisation of an
+origin ({{!RFC6454}}, Section 6.2). If parsing fails, the field MUST be ignored.
+
+Senders should note that, as per {{!RFC6454}} Section 4, the values in an ORIGIN header need to be
+case-normalised before serialisation.
+
+Once parsed, the value MUST have:
+
+* a scheme of "https", 
+* a host that is reflected in a `subjectAltName` of the connection's TLS certificate (using the wildcard rules defined in {{!RFC2818}}, Section 3.1), and 
+* a port that reflects the connection's remote port on the client.

@mcmanus see latest commit; I defer the cert checks until use of the origin, and I think that takes care of the concerns here.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_58991a628604_65423f8b2b26d1306855a-- From nobody Mon Feb 6 18:15:22 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -0.616 X-Spam-Level: X-Spam-Status: No, score=-0.616 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_28=1.404, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=github.com; h=from:reply-to:to:cc:in-reply-to:references:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=jDDSNjm6+fiI83DnSku6JCzh1NI=; b=pKxY4V9qanHyvz2R px2ii7ICgdRNtv1yPgrC01JCxbk5Xdn65xyTfa2NHVGIl0VAn1K6LBg+xQCiW8St ozJMEaNk4cmj6jYo358CoHwwckHZvzI+CN/9dVNqZRsT5LmivisRhH0qhEmXqosI xZcVW/ZMFo2wbaOCEfYPFUwak/M= Date: Mon, 06 Feb 2017 18:15:17 -0800 To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] DNS relaxation, smaller initial Origin Set (#285) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_58992db56a177_14bd3fd45f45513c1687b1"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 07 Feb 2017 02:15:21 -0000 ----==_mimepart_58992db56a177_14bd3fd45f45513c1687b1 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit mnot commented on this pull request. > -The ORIGIN frame allows the server to modify the Origin Set. In particular: + - Scheme: "https" + - Host: the value sent in Server Name Indication ({{!RFC6066}} Section 3), converted to lower case + - Port: the local port of the connection on the server I'm inclined to think that if you want to host an alternative service and send ORIGIN, you need to explicitly list the alternative in ORIGIN. The client *could* make some assumptions, but that doesn't seem great. Thoughts? -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/pull/285 ----==_mimepart_58992db56a177_14bd3fd45f45513c1687b1 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

@mnot commented on this pull request.

In draft-ietf-httpbis-origin-frame.md:

>  
-The ORIGIN frame allows the server to modify the Origin Set. In particular:
+  - Scheme: "https"
+  - Host: the value sent in Server Name Indication ({{!RFC6066}} Section 3), converted to lower case
+  - Port: the local port of the connection on the server

I'm inclined to think that if you want to host an alternative service and send ORIGIN, you need to explicitly list the alternative in ORIGIN. The client could make some assumptions, but that doesn't seem great. Thoughts?

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_58992db56a177_14bd3fd45f45513c1687b1-- From nobody Mon Feb 6 18:15:57 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -4.569 X-Spam-Level: X-Spam-Status: No, score=-4.569 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_24=1.618, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H2=-1.887, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=github.com; h=from:reply-to:to:cc:in-reply-to:references:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=5su96QjeHamco2UDQKksF/L0MHE=; b=SIO/xrtZpRD6Oq3I 7edO+caSDB482f8FhTurm099ni4ZzertmCakNa12kHbELe7G+TukOLITf23niRsM RlNh8w4MvWpqYecz3CLOQszZtjG5XT/6WgtDGisKIRtBw28z37ogVhrBUN21fbJh oT47tP0YNRcj7a8xQ+i+//oTaGs= Date: Mon, 06 Feb 2017 18:15:53 -0800 To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] DNS relaxation, smaller initial Origin Set (#285) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_58992dd9322df_3e283f8e7886114095193"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Push Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 07 Feb 2017 02:15:56 -0000 ----==_mimepart_58992dd9322df_3e283f8e7886114095193 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit @mnot pushed 1 commit. 6b3b761 correct port -- You are receiving this because you are subscribed to this thread. View it on GitHub: https://github.com/httpwg/http-extensions/pull/285/files/85209385ab88ed6d90f2507d47fc2e7865516a6e..6b3b76186c3eecbeace6bbd7bbbb8a040b502006 ----==_mimepart_58992dd9322df_3e283f8e7886114095193 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

@mnot pushed 1 commit.

—
You are receiving this because you are subscribed to this thread.
View it on GitHub or mute the thread.

----==_mimepart_58992dd9322df_3e283f8e7886114095193-- From nobody Mon Feb 6 21:06:45 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -0.402 X-Spam-Level: X-Spam-Status: No, score=-0.402 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_24=1.618, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=github.com; h=from:reply-to:to:cc:in-reply-to:references:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=4Cv3dwndCY6TrUloqi0ncPuP93E=; b=mNlrjys/hfcRiKyq IzQUDNolnyc57DhSYx3iUgNESAsM/P/pQItQ7QHqeYmrW+SQmkmwu4jsTWyFCO47 q4ZZ19HvkFbe8ESCdxDd7/C5yKd77J1zXYAZI7D3maapLo2FfC6FhJYC0dupHQzO 2jwOAW4I9GZ6z/ZnOzdsK+EvwcA= Date: Mon, 06 Feb 2017 21:06:40 -0800 To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] Digest algorithm (#228) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_589955e013a5a_67163fb449a1d140291733"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 07 Feb 2017 05:06:44 -0000 ----==_mimepart_589955e013a5a_67163fb449a1d140291733 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit That's very helpful, thanks. Given that, I think we can close this issue with no action (reopening if we learn something new, of course). -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/issues/228#issuecomment-277902931 ----==_mimepart_589955e013a5a_67163fb449a1d140291733 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

That's very helpful, thanks. Given that, I think we can close this issue with no action (reopening if we learn something new, of course).

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_589955e013a5a_67163fb449a1d140291733-- From nobody Mon Feb 6 21:07:06 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -0.402 X-Spam-Level: X-Spam-Status: No, score=-0.402 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_24=1.618, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=github.com; h=from:reply-to:to:cc:in-reply-to:references:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=HzPY59rDCsOropYplsA9Ze3i874=; b=nRUxB56Wz4YQwx/P piaslps0MPBx/rWxqRpqXDiPgB9wkKXD5IVF+GsqnXJGDQEEXleUSllTu4cUszpn 5Cmh2y24EsmbAlWoAWJfyq4d103vOHq9/65RobWnWPA+85F7MC6oPSrXfZMO39ZH 1NnVBUiiphu1IQ0GOJR81rWYPp0= Date: Mon, 06 Feb 2017 21:06:40 -0800 To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] Digest algorithm (#228) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_589955e0fe96_62dd3fa15da95130266458"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 07 Feb 2017 05:07:04 -0000 ----==_mimepart_589955e0fe96_62dd3fa15da95130266458 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Closed #228. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/issues/228#event-951492572 ----==_mimepart_589955e0fe96_62dd3fa15da95130266458 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

Closed #228.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_589955e0fe96_62dd3fa15da95130266458-- From nobody Mon Feb 6 21:25:31 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -4.641 X-Spam-Level: X-Spam-Status: No, score=-4.641 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_20=1.546, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H2=-1.887, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=github.com; h=from:reply-to:to:cc:in-reply-to:references:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=xJNQqtTj56N66tAoYYSsi4bYVsE=; b=XxcUySfgTOVLX8/F Qe+SZSXVhVJanIkBBHvf0fIIcLuT/8feX7Ovw8khRu5679BHUIKUvfdkymSFWvnf mMxC2oVwD8rZSoCCz07Dzx+PjyUdvD50kExkd2FyxazuFw6LpSoZAjwqaaiDl1BV tY5iz6f4QtTDAqxCQMt+4hBx7to= Date: Mon, 06 Feb 2017 21:25:24 -0800 To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] Lifetime of Key headers (#187) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_58995a44a08fd_8ef3fc6d2d2d13c4913"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 07 Feb 2017 05:25:30 -0000 ----==_mimepart_58995a44a08fd_8ef3fc6d2d2d13c4913 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit That was the intent, yes. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/issues/187#issuecomment-277905075 ----==_mimepart_58995a44a08fd_8ef3fc6d2d2d13c4913 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

That was the intent, yes.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_58995a44a08fd_8ef3fc6d2d2d13c4913-- From nobody Mon Feb 6 21:27:37 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -4.569 X-Spam-Level: X-Spam-Status: No, score=-4.569 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_24=1.618, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H2=-1.887, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=github.com; h=from:reply-to:to:cc:in-reply-to:references:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=dNKfE9DodugYrsPA3sZmzaCS4ZY=; b=bqbPUWuwC9U2Zqsn VbbZXcT2GI8qj8leQiM15wWrSGRn7MexkDEyb6s2AzkaGazHYUWImreIz3Pfgvmy 7gvDG7qC8PEAsMLMtviyF5ler1GPFPopcS2ntf7Jh1Y5RadAqUIPTZLSpkzict4b MQGFNyr3bHrUcQqxThBWXgRFUQM= Date: Mon, 06 Feb 2017 21:27:33 -0800 To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] fix typo bit -> be (#276) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_58995ac517c22_54bf3fba655bd13c35789a"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 07 Feb 2017 05:27:36 -0000 ----==_mimepart_58995ac517c22_54bf3fba655bd13c35789a Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Merged #276. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/pull/276#event-951507055 ----==_mimepart_58995ac517c22_54bf3fba655bd13c35789a Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

Merged #276.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_58995ac517c22_54bf3fba655bd13c35789a-- From nobody Mon Feb 6 21:29:13 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -7.268 X-Spam-Level: X-Spam-Status: No, score=-7.268 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_24=1.618, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H2=-1.887, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Date: Mon, 06 Feb 2017 21:29:08 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1486445348; bh=D+zEuyo6wUVW9JfhKNPUazFoscoOh6wwJoYzoLm/7Jg=; h=From:Reply-To:To:Cc:In-Reply-To:References:Subject:List-ID: List-Archive:List-Post:List-Unsubscribe:From; b=PMWuylap1hREx1RJgSSMD+fHSHEEmeo7/ZPwz4ROZQWXRAcuVo8tc3P14i7DjE97Q cqEV+kCBu7qRxsGBCj2uTWSimZ26busRs1YImCqkSVPar4jo2Ra3M7BfDL6NRMP+V9 jQroCYpIQtmez4ad0GWI8u8NJqVWSCysxFl8a6Rw= To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] spell Golomb correctly (#275) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_58995b24b2ce5_5db03fc6d2d2d13c115090"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 07 Feb 2017 05:29:12 -0000 ----==_mimepart_58995b24b2ce5_5db03fc6d2d2d13c115090 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Merged #275. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/pull/275#event-951508157 ----==_mimepart_58995b24b2ce5_5db03fc6d2d2d13c115090 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

Merged #275.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_58995b24b2ce5_5db03fc6d2d2d13c115090-- From nobody Mon Feb 6 21:29:32 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -2.269 X-Spam-Level: X-Spam-Status: No, score=-2.269 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_24=1.618, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-1.887, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=github.com; h=from:reply-to:to:cc:in-reply-to:references:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=crR0hsbkPqjPTt2CzhiliiNisgo=; b=CsbCLtUPk7SnYZee CNskWNp/NMoql6R1aYgQp0P0/AoR+LO1xJYcBYy5KLbaAytdQ6xTfPG1WGvxZw8q 4DGBEQbBAkFpWcnERMLRa998LRurYoBTL/n4jxfobxQd41wlOtbdxIiYswrWNQhD TK9Xn7By8ODEr1SnJKargn6+qrc= Date: Mon, 06 Feb 2017 21:29:28 -0800 To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] incorrect IPR (#244) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_58995b381588d_1ad23fd34168f138229442"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 07 Feb 2017 05:29:31 -0000 ----==_mimepart_58995b381588d_1ad23fd34168f138229442 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Merged #244. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/pull/244#event-951508341 ----==_mimepart_58995b381588d_1ad23fd34168f138229442 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

Merged #244.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_58995b381588d_1ad23fd34168f138229442-- From nobody Tue Feb 7 04:22:03 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -0.616 X-Spam-Level: X-Spam-Status: No, score=-0.616 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_28=1.404, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=github.com; h=from:reply-to:to:cc:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=SCQcMacEBGFJcOYDBCO/zJIhShM=; b=lzWOLUljFLPMGZL8 gWBlYAGy43Rwy0f81MhCP+bvT5xiQHzbxkxa9Yh4/NJjet1gsq/Iw4SCLzy0c9iM on9/6iBhoY+zwwEvA1+Tnp0AGxyd0oggzcQjCvJmtEaum4UkI+FwQhxmiaox8BYy QU1xPqfKv48iiUKpzqNyqN5odGg= Date: Tue, 07 Feb 2017 04:21:36 -0800 To: httpwg/http-extensions Subject: [httpwg/http-extensions] Cite a recent HTML spec (#292) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_5899bbd08cc0e_65293fd94ca371301351fb"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 07 Feb 2017 12:22:02 -0000 ----==_mimepart_5899bbd08cc0e_65293fd94ca371301351fb Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit You can view, comment on, or merge this pull request online at: https://github.com/httpwg/http-extensions/pull/292 -- Commit Summary -- * Cite a recent HTML spec -- File Changes -- M draft-ietf-httpbis-expect-ct.md (2) -- Patch Links -- https://github.com/httpwg/http-extensions/pull/292.patch https://github.com/httpwg/http-extensions/pull/292.diff -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/pull/292 ----==_mimepart_5899bbd08cc0e_65293fd94ca371301351fb Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

You can view, comment on, or merge this pull request online at:

  https://github.com/httpwg/http-extensions/pull/292

Commit Summary

  • Cite a recent HTML spec

File Changes

Patch Links:

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_5899bbd08cc0e_65293fd94ca371301351fb-- From nobody Tue Feb 7 09:55:48 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -2.019 X-Spam-Level: X-Spam-Status: No, score=-2.019 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_32=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=github.com; h=from:reply-to:to:cc:in-reply-to:references:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=KYNjZRqASiAN7c/Jl0FtprRZ5v8=; b=i4jdIXHe7oUtDhrD lkWap19tvSs4kYarnTpOP+Oy6lPWERwiShqusjwVs8z92i1CO7aFfBw2K1kA0YDu VY/tuuW+ubOtZBhfKLeOJx7sYm6g2nZabzg1ZmK4JLK8YciCBW45FayS4GXiEiPT RQj6y/BjwqmmUp6k4fvqcUOxlcM= Date: Tue, 07 Feb 2017 09:55:37 -0800 To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] DNS relaxation, smaller initial Origin Set (#285) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_589a0a19d3735_6ac83fd6ce65f13c489e5"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 07 Feb 2017 17:55:46 -0000 ----==_mimepart_589a0a19d3735_6ac83fd6ce65f13c489e5 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit On Mon, Feb 6, 2017 at 9:15 PM, Mark Nottingham wrote: > I'm inclined to think that if you want to host an alternative service and > send ORIGIN, you need to explicitly list the alternative in ORIGIN. The > client *could* make some assumptions, but that doesn't seem great. > Thoughts? > wait - no. You wouldn't send the alternative in the ORIGIN frame, you would send the origin that you are the alternative for, right? that would make sense - if you want to use an alternative you can't rely on the SNI default. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/pull/285#issuecomment-278083944 ----==_mimepart_589a0a19d3735_6ac83fd6ce65f13c489e5 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable On Mon, Feb 6, 2017 at 9:15 PM, Mark Nottingham <notifications@github.co= m>
wrote:

> I'm inclined to think that if you want to host an alternative serv= ice and
> send ORIGIN, you need to explicitly list the alternative in ORIGIN. Th= e
> client *could* make some assumptions, but that doesn't seem great.=
> Thoughts?
>

wait - no. You wouldn't send the alternative in the ORIGIN frame, you w= ould
send the origin that you are the alternative for, right? that would make
sense - if you want to use an alternative you can't rely on the SNI def= ault.

&mda= sh;
You are receiving this because you are subscribed to this thread.<= br />Reply to this email directly, view it on GitHub, or mute the thread.3D""

= ----==_mimepart_589a0a19d3735_6ac83fd6ce65f13c489e5-- From nobody Wed Feb 8 12:28:00 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -4.784 X-Spam-Level: X-Spam-Status: No, score=-4.784 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_28=1.404, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H2=-1.887, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=github.com; h=from:reply-to:to:cc:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=oZ/xqKiSmAPOp1zJP03d6b+KzDQ=; b=nfg07V67+iviI4Nu A266oCsmXXkjaUebL35D5GqfjUVMEmPFpEbiZgMuc8yxdp50HjZza4N3pZUMOwyh 6IuRlyte7Gmw+VIt1vIENqNDnIrRpfF/LIfVxZl4vIOJDEZXA+W7BOVpjfrFGhAJ 4aVrfC8BWd/WQXfgHs/EkGdRNck= Date: Wed, 08 Feb 2017 12:27:54 -0800 To: httpwg/http-extensions Subject: [httpwg/http-extensions] don't cite RFC 2616, it's obsolete (#293) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_589b7f4a63b77_71b83f88ca74f134106678"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 08 Feb 2017 20:27:59 -0000 ----==_mimepart_589b7f4a63b77_71b83f88ca74f134106678 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit You can view, comment on, or merge this pull request online at: https://github.com/httpwg/http-extensions/pull/293 -- Commit Summary -- * don't cite RFC 2616, it's obsolete -- File Changes -- M draft-ietf-httpbis-expect-ct.md (2) -- Patch Links -- https://github.com/httpwg/http-extensions/pull/293.patch https://github.com/httpwg/http-extensions/pull/293.diff -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/pull/293 ----==_mimepart_589b7f4a63b77_71b83f88ca74f134106678 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

You can view, comment on, or merge this pull request online at:

  https://github.com/httpwg/http-extensions/pull/293

Commit Summary

  • don't cite RFC 2616, it's obsolete

File Changes

Patch Links:

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_589b7f4a63b77_71b83f88ca74f134106678-- From nobody Wed Feb 8 12:38:27 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -0.475 X-Spam-Level: X-Spam-Status: No, score=-0.475 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_20=1.546, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=github.com; h=from:reply-to:to:cc:in-reply-to:references:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=X3QTEVefNFk+xXONU/J3+E+TbUI=; b=gWOBlzGSca3z1DVd QgGbh+ou1zWUMGvtcLUyWggj32Myt5IxxUk+vWZc51q3UBTbFzNgBDwPBG86FVbk H61ZDcb1e0ZBXL6TZT85YudRM/GsVkJlf0YlOXrwMVMpAO86OrZdx49DbAV2SauI Sf0gUdDrGZCKHD1vmoRRZ0/LGMw= Date: Wed, 08 Feb 2017 12:38:20 -0800 To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] don't cite RFC 2616, it's obsolete (#293) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_589b81bc54b19_b723f88ca74f13430071"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 08 Feb 2017 20:38:26 -0000 ----==_mimepart_589b81bc54b19_b723f88ca74f13430071 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Thanks! -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/pull/293#issuecomment-278454182 ----==_mimepart_589b81bc54b19_b723f88ca74f13430071 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

Thanks!

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_589b81bc54b19_b723f88ca74f13430071-- From nobody Wed Feb 8 12:38:37 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -2.703 X-Spam-Level: X-Spam-Status: No, score=-2.703 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_24=1.618, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=github.com; h=from:reply-to:to:cc:in-reply-to:references:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=pDE9hHP0FJsM88OssXGJIr3FUUg=; b=g9OzagwoIWge/JwT /F1HmqjhcEGQRCb0Y1mXu5mqay2WIg9HwvKXVZxDi57HRZI5e6+XGdjCkHIom20x bYbZsA8S3i1pcYAUxjXGiteg2cNeRZI39dxqSJIC5g4WOmcLuzh0JQ2iESP93Zz/ hbagEpwvuYB77qvoMfqe9TUqVaw= Date: Wed, 08 Feb 2017 12:38:17 -0800 To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] don't cite RFC 2616, it's obsolete (#293) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_589b81b94d259_13c03fcce52d51302657d4"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 08 Feb 2017 20:38:37 -0000 ----==_mimepart_589b81b94d259_13c03fcce52d51302657d4 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Merged #293. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/pull/293#event-954524355 ----==_mimepart_589b81b94d259_13c03fcce52d51302657d4 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

Merged #293.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_589b81b94d259_13c03fcce52d51302657d4-- From nobody Wed Feb 8 15:33:42 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -2.021 X-Spam-Level: X-Spam-Status: No, score=-2.021 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=github.com; h=from:reply-to:to:cc:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=/PuLBluJE9DFZGzne8GqaZ+W4IM=; b=EYpxwweO1TcCoIPY yD+MAA7WwZdJIjGmopZaY/s8trOPUVXzr8MGL+PCaLYh9FCeMHr5WQFH4EG8/tJQ DTBrDs04iCp4pUayjJ0Thq6mPTPFlyHXsx45pqNWNGCfSIFdPeGnNTaobHXDcDf8 LzzzzKCjNq+9+41yY0Phc7AV2Ss= Date: Wed, 08 Feb 2017 15:31:58 -0800 To: httpwg/http-extensions Subject: [httpwg/http-extensions] Issues from old repo (#294) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_589baa6ebdf1c_63b33fa2b540913c195783"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 08 Feb 2017 23:33:41 -0000 ----==_mimepart_589baa6ebdf1c_63b33fa2b540913c195783 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit I want to address these issues that were filed in the old repo https://github.com/bifurcation/expect-ct/: - [ ] https://github.com/bifurcation/expect-ct/issues/18 - [ ] https://github.com/bifurcation/expect-ct/issues/16 - [ ] https://github.com/bifurcation/expect-ct/issues/7 - [ ] https://github.com/bifurcation/expect-ct/issues/6 - [ ] https://github.com/bifurcation/expect-ct/issues/4 -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/issues/294 ----==_mimepart_589baa6ebdf1c_63b33fa2b540913c195783 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

I want to address these issues that were filed in the old repo https://github.com/bifurcation/expect-ct/:

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_589baa6ebdf1c_63b33fa2b540913c195783-- From nobody Wed Feb 8 18:28:49 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -2.483 X-Spam-Level: X-Spam-Status: No, score=-2.483 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_28=1.404, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-1.887, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=github.com; h=from:reply-to:to:cc:in-reply-to:references:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=Ay1+rkZv6ELZWRPwi0FW0kSJNm0=; b=OQM0NMSqee2+tYdS 0sk6g4pjmVgyW4nicJ0QCiCo+h7pW0ZU7112dzwpCTwJJx6rY+gp9nPc1yfjagZP UQcjbzcLH3+c2b/7BpJfgrtaMIW7tOFkELEWRuP1kdsO3JapZ4hqjWSwy9NH/Y7M ohYsBA9I1sUOt3wSRLwo/u2ubTQ= Date: Wed, 08 Feb 2017 18:28:43 -0800 To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] Enabling O(1) removal from digest (#268) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_589bd3dbb06d3_11cc3fa005333134992b1"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 09 Feb 2017 02:28:47 -0000 ----==_mimepart_589bd3dbb06d3_11cc3fa005333134992b1 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Anyone willing to do a pull request for Cuckoo filters? The paper has better algorithm definitions, so we can avoid some of the details, but we still need to define a wire serialisation. Maybe use https://github.com/Leechael/python-cuckoo/blob/master/cuckoofilter/cuckoofilter.py#L143 as a starting point and figure out if we need to make changes / optimisations? That one appears to gzip pretty well, so there's likely space for improvement. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/issues/268#issuecomment-278528723 ----==_mimepart_589bd3dbb06d3_11cc3fa005333134992b1 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable

Anyone willing to do a pull request for Cuckoo filters? The paper has be= tter algorithm definitions, so we can avoid some of the details, but we sti= ll need to define a wire serialisation.

Maybe use https://github.com/Leechael/python-cu= ckoo/blob/master/cuckoofilter/cuckoofilter.py#L143 as a starting point = and figure out if we need to make changes / optimisations? That one appears= to gzip pretty well, so there's likely space for improvement.

&mda= sh;
You are receiving this because you are subscribed to this thread.<= br />Reply to this email directly, view it on GitHub, or <= a href=3D"https://github.com/notifications/unsubscribe-auth/AORpyIVVPZKIGFH= eVK8xsB6YdEIKwlzEks5rannbgaJpZM4K1Rdh">mute the thread.3D""

= ----==_mimepart_589bd3dbb06d3_11cc3fa005333134992b1-- From nobody Thu Feb 9 02:58:14 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -6.187 X-Spam-Level: X-Spam-Status: No, score=-6.187 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H2=-1.887, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=github.com; h=from:reply-to:to:cc:in-reply-to:references:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=t7sEoNJ91bls55IofowyTnGJ7bw=; b=F9gtjoMP9NRDQHDc gXg+3KRVvDE91OqeGvws1aaL8zjAQW/DZrt17FdPGluovlO7ZLyQ2EQrmjkfX+jP 9y3um+V4LqMya+hHKNdjNtDYX0LQcq4WY3I4TSO+tbQoa5c+t9642L1aRRyKd5DP 4hw/qmYM/oJPWzkwRZaHAqCd6dQ= Date: Thu, 09 Feb 2017 02:58:08 -0800 To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] Requiring Accept-CH (#284) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_589c4b40e0029_77623fd2967b713833183c"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 09 Feb 2017 10:58:12 -0000 ----==_mimepart_589c4b40e0029_77623fd2967b713833183c Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Please note that such a requirement will significantly reduce the capability of servers to adapt the main HTML document to viewport dimensions, network conditions, etc. So while I understand the need to reduce passive fingerprinting, I think the decision should be on a per-hint basis and based on the info that the hints actually expose. For example, I'd argue in the case of viewport dimensions and screen density, that info is already exposed in the UA string (along with other, more specific data on the user's device and browser), and the hints only make it easier to adapt content without a device DB, while not necessarily increasing fingerprinting capabilities. As for network conditions, while exposing them may add data to the fingerprinter's toolbox, they can vary wildly between sessions (and even during a session), so I'd argue they don't necessarily increase fingerprinting capabilities. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/issues/284#issuecomment-278610132 ----==_mimepart_589c4b40e0029_77623fd2967b713833183c Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable

Please note that such a requirement will significantly reduce the capabi= lity of servers to adapt the main HTML document to viewport dimensions, net= work conditions, etc. So while I understand the need to reduce passive fing= erprinting, I think the decision should be on a per-hint basis and based on= the info that the hints actually expose.

For example, I'd argue in the case of viewport dimensions and screen den= sity, that info is already exposed in the UA string (along with other, more= specific data on the user's device and browser), and the hints only make i= t easier to adapt content without a device DB, while not necessarily increa= sing fingerprinting capabilities.

As for network conditions, while exposing them may add data to the finge= rprinter's toolbox, they can vary wildly between sessions (and even during = a session), so I'd argue they don't necessarily increase fingerprinting cap= abilities.

&mda= sh;
You are receiving this because you are subscribed to this thread.<= br />Reply to this email directly, view it on GitHub, or <= a href=3D"https://github.com/notifications/unsubscribe-auth/AORpyCFcAVNBdUv= vOxZDvfwZTCPvwvPvks5ravFAgaJpZM4LyUDH">mute the thread.3D""

= ----==_mimepart_589c4b40e0029_77623fd2967b713833183c-- From nobody Sat Feb 11 01:47:04 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -8.886 X-Spam-Level: X-Spam-Status: No, score=-8.886 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H2=-1.887, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Date: Sat, 11 Feb 2017 01:47:00 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1486806420; bh=wDJyTXA0ZhHZsaSKD+zSICt1w49lczHH76791iNcn1s=; h=From:Reply-To:To:Cc:In-Reply-To:References:Subject:List-ID: List-Archive:List-Post:List-Unsubscribe:From; b=FNl8nL8aegqcrogIIIXZmobRalUvF4TiL3In5V8Z9Oj+J/ikfawnV/6DqoMzSZLem wVpZsBiAkVlmYacSQU6QIB/kJsj4WuFxHgBQ1o9ZHYczGm9r1Bha+TCqiKi79eOHSO elZNV/nvhYW3vFdcZ1LnTJLfBui03hpHTwTrufFo= To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] Requiring Accept-CH (#284) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_589edd9443682_7ed23fa48fdf71401348bc"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 11 Feb 2017 09:47:03 -0000 ----==_mimepart_589edd9443682_7ed23fa48fdf71401348bc Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit CH is not just for browsers. There are other types of clients: native apps that talk to own backends, internal HTTP clients that talk to image servers, and so on. As such, I don't think we're in a position to make sweeping formal (MUST) requirements for how/when support for these hints should be advertised or when they can be sent. Existing section for Accept-CH starts with "servers can advertise support".. which, I think, is the right approach. The other relevant section is... https://tools.ietf.org/html/draft-ietf-httpbis-client-hints-03#section-2.1 > 2.1. Sending Client Hints > > Clients control which Client Hint headers and their respective header > fields are communicated, based on their default settings, user > configuration and/or preferences. The user can be given the choice > to enable, disable, or override specific hints. > > The client and server, or an intermediate proxy, can use an opt-in > mechanism to negotiate which fields should be reported to allow for > efficient content adaption. I believe the above already covers all the cases we brought up here and on the list? -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/issues/284#issuecomment-279133287 ----==_mimepart_589edd9443682_7ed23fa48fdf71401348bc Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable

CH is not just for browsers. There are other types of clients: native = apps that talk to own backends, internal HTTP clients that talk to image = servers, and so on. As such, I don't think we're in a position to make sw= eeping formal (MUST) requirements for how/when support for these hints sh= ould be advertised or when they can be sent.

Existing section for Accept-CH starts with "servers can advertise supp= ort".. which, I think, is the right approach. The other relevant section = is...

https://tools.ietf.org/html/draft-ietf-httpbis-client-hi= nts-03#section-2.1

2.1. Sending Client Hints

Clients control which Client Hint headers and their respective header<= br> fields are communicated, based on their default settings, user
configuration and/or preferences. The user can be given the choice
to enable, disable, or override specific hints.

The client and server, or an intermediate proxy, can use an opt-in
= mechanism to negotiate which fields should be reported to allow for
efficient content adaption.

I believe the above already covers all the cases we brought up here an= d on the list?

&m= dash;
You are receiving this because you are subscribed to this thre= ad.
Reply to this email directly, view it on GitHub, or mute the thread.

=
= ----==_mimepart_589edd9443682_7ed23fa48fdf71401348bc-- From nobody Sat Feb 11 03:37:20 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -2.719 X-Spam-Level: X-Spam-Status: No, score=-2.719 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_32=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=github.com; h=from:reply-to:to:cc:in-reply-to:references:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=9Wxr+H5bi+Fp/3MGsxO0VFfwbBQ=; b=Kb3GfzZbqpRYmCsH uIPYFQIpBuI0iLHMLUTUXzBmErzVvnLK/5zUZqOu2rrJZx9BLYyG5P/nDBcTESry 8WJkb+xHyixVH/dHUMwPj5rarfcgQZxlJjEA5HAmM7Pr/vfsMR7jBAGg2DPKUgim wC8MH9Ii3wr3u/vHlno0VFbEH2Q= Date: Sat, 11 Feb 2017 03:37:15 -0800 To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] Requiring Accept-CH (#284) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_589ef76bcf104_130f3fa48fdf7140915b"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 11 Feb 2017 11:37:19 -0000 ----==_mimepart_589ef76bcf104_130f3fa48fdf7140915b Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit If hints are capable of uniquely identifying a user's device then the data communicated is personal data. If it concerns a European resident then before it is processed, meaning collected or used, the user must give their consent. This is a legal requirement in Europe, which will be strongly enforced after the GDPR and the new ePrivacy Regulation come into force next year. This inevitably means that sending an Accept-CH requires opt-in consent. If the browser does not require it then all the sites (in Europe or elsewhere if directed at European residents) will have to. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/issues/284#issuecomment-279138444 ----==_mimepart_589ef76bcf104_130f3fa48fdf7140915b Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable

If hints are capable of uniquely identifying a user's device then the da= ta communicated is personal data. If it concerns a European resident then b= efore it is processed, meaning collected or used, the user must give their = consent. This is a legal requirement in Europe, which will be strongly enfo= rced after the GDPR and the new ePrivacy Regulation come into force next ye= ar.
This inevitably means that sending an Accept-CH requires opt-in consent. If= the browser does not require it then all the sites (in Europe or elsewhere= if directed at European residents) will have to.

&mda= sh;
You are receiving this because you are subscribed to this thread.<= br />Reply to this email directly, view it on GitHub, or <= a href=3D"https://github.com/notifications/unsubscribe-auth/AORpyF3GxX8AoEe= JEiQ6Eth4kF5ndN_nks5rbZ1rgaJpZM4LyUDH">mute the thread.3D""

= ----==_mimepart_589ef76bcf104_130f3fa48fdf7140915b-- From nobody Sat Feb 11 04:43:47 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -4.569 X-Spam-Level: X-Spam-Status: No, score=-4.569 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_24=1.618, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H2=-1.887, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=github.com; h=from:reply-to:to:cc:in-reply-to:references:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=j/dvpSASTIZK9cDGHSgsuHRMvXM=; b=J+VyucH19AMyTz0I Y9hiBhijFOd/GNSC9jASRtn0C2Cfq6BV0PGZgQO0eJTdMxfopzh+x5lBiOFcBnSJ GsDA5uZcWZUdWvAJSc/TNEc5n4a7pfxlNgXFuYD7gYFI2K16dGUuRDMyD3amkiWU a6UW87OBBIR6/a+Eou2alN4nJYc= Date: Sat, 11 Feb 2017 04:43:42 -0800 To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] Requiring Accept-CH (#284) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_589f06fe55521_427b3fee74d7b138968f0"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 11 Feb 2017 12:43:46 -0000 ----==_mimepart_589f06fe55521_427b3fee74d7b138968f0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit That may be true for hints that are capable of uniquely identifying a user, but irrelevant for hints that are not. Therefore, we shouldn't impose a rule requiring an opt in for all hints. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/issues/284#issuecomment-279141602 ----==_mimepart_589f06fe55521_427b3fee74d7b138968f0 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

That may be true for hints that are capable of uniquely identifying a user, but irrelevant for hints that are not. Therefore, we shouldn't impose a rule requiring an opt in for all hints.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_589f06fe55521_427b3fee74d7b138968f0-- From nobody Sat Feb 11 05:29:08 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -7.268 X-Spam-Level: X-Spam-Status: No, score=-7.268 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_24=1.618, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H2=-1.887, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Date: Sat, 11 Feb 2017 05:29:03 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1486819743; bh=Z4dmmrtqbBOT5p9C54PjA5raBEDNXg32HoaNPrDAA/Q=; h=From:Reply-To:To:Cc:In-Reply-To:References:Subject:List-ID: List-Archive:List-Post:List-Unsubscribe:From; b=jijgOJZaoULkAH72eaK0ne9DOoyWVOQ6DHe2AahlW4E2cBvW8NyvAF4W3EFSo5fm1 8shNf+Xk01xi4b2qZSdXfRWn6++i/iNDutEeNHvC1gAbvPKdqzHgbLl4WHfgqFT8uH vKhOOOBYDz7PdkCfHY+8Pj12dHS55+ncMdW/LsHs= To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] Requiring Accept-CH (#284) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_589f119f79caf_44873fb40a18f13418068a"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 11 Feb 2017 13:29:06 -0000 ----==_mimepart_589f119f79caf_44873fb40a18f13418068a Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit The more hints the more entropy. If an origin can place Accept-CH they can use that to single-out the user without their knowledge, unless opt-in is required. How could entropy be reduced? Can it be quantified? -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/issues/284#issuecomment-279143807 ----==_mimepart_589f119f79caf_44873fb40a18f13418068a Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable

The more hints the more entropy. If an origin can place Accept-CH they= can use that to single-out the user without their knowledge, unless opt-= in is required.
How could entropy be reduced? Can it be quantified?

&m= dash;
You are receiving this because you are subscribed to this thre= ad.
Reply to this email directly, view it on GitHub, or mute the thread.

=
= ----==_mimepart_589f2ba76549b_457c3fe1d4f8b13c8703c-- From nobody Sun Feb 12 15:31:49 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -0.403 X-Spam-Level: X-Spam-Status: No, score=-0.403 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_24=1.618, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=github.com; h=from:reply-to:to:cc:in-reply-to:references:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=8gImI7dWQ1ExE8e0wRThV69QZfk=; b=BvVqU1XWYNyawLtX qLvqVA5gCSjtFAyy/on+SJiJaHRALdLBJOndJyhuEin4n49rYBlm3Dr+1Kn7U06x A1sByUPFR7aGhbIZXluzJmDJVaIb3QyVHutLhwzOJwDz2flXEj1rf35k6i0+nB8C Xzc/LMCq/nz+Gb6KhunYWr1R2Xg= Date: Sun, 12 Feb 2017 15:31:44 -0800 To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] Move to using padding that is more like TLS (#283) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_58a0f06043a37_2d253fc58fc21138847cd"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 12 Feb 2017 23:31:47 -0000 ----==_mimepart_58a0f06043a37_2d253fc58fc21138847cd Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Merged #283. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/pull/283#event-958848482 ----==_mimepart_58a0f06043a37_2d253fc58fc21138847cd Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

Merged #283.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_58a0f06043a37_2d253fc58fc21138847cd-- From nobody Sun Feb 12 17:15:36 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -8.886 X-Spam-Level: X-Spam-Status: No, score=-8.886 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H2=-1.887, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Date: Sun, 12 Feb 2017 17:15:22 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1486948522; bh=2VLzwTUU1i8xq3DOYPb2qeilS6R8YrIzZaMy4PlvNPM=; h=From:Reply-To:To:Cc:In-Reply-To:References:Subject:List-ID: List-Archive:List-Post:List-Unsubscribe:From; b=QVO4P/VuOcouZFPMokXxPVhjDQFULrjYPAsyqb3SKXVF2Y8Fx02hfom7siyn1wjoo goMH2ymX+DlA3WiqYNaDSRkIb0FgbzgBYsCx6sKp5jSb3+O7fEMSSZ+gYxiNOdRbmQ 7FoAa1gqV7QpcY2blJVZZI27UijLgL8A6lTygHSk= To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] Requiring Accept-CH (#284) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_58a108aa42119_40ee3fb7f3e411386470"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Feb 2017 01:15:34 -0000 ----==_mimepart_58a108aa42119_40ee3fb7f3e411386470 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit @igrigorik I recognize that Client Hints could be used by HTTP implementations that aren't a browser being used by a user. It seems like in most (or all?) of those suggested cases, a developer controls the server and the client and sending `Accept-CH` wouldn't be a challenge. (That said, it might be that this could be a SHOULD, or a requirement that explicitly describes the situations where it doesn't need to be followed.) While the current language provides flexibility to the client implementation, I think there are interoperability reasons to specify conditions that support user privacy here. Providing the expectation in the spec that the server receives Client Hints only if it has asked for them means that developers won't have to check UA implementations individually to try to figure out how to receive hints and UA implementers will have a common required condition which will benefit all users' privacy in providing for more detectability. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/issues/284#issuecomment-279272786 ----==_mimepart_58a108aa42119_40ee3fb7f3e411386470 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable

@igrig= orik I recognize that Client Hints could be used by HTTP implementati= ons that aren't a browser being used by a user. It seems like in most (or= all?) of those suggested cases, a developer controls the server and the = client and sending Accept-CH wouldn't be a challenge. (That = said, it might be that this could be a SHOULD, or a requirement that expl= icitly describes the situations where it doesn't need to be followed.)

While the current language provides flexibility to the client implemen= tation, I think there are interoperability reasons to specify conditions = that support user privacy here. Providing the expectation in the spec tha= t the server receives Client Hints only if it has asked for them means th= at developers won't have to check UA implementations individually to try = to figure out how to receive hints and UA implementers will have a common= required condition which will benefit all users' privacy in providing fo= r more detectability.

&m= dash;
You are receiving this because you are subscribed to this thre= ad.
Reply to this email directly, view it on GitHub, or mute the thread.

=
= ----==_mimepart_58a108aa42119_40ee3fb7f3e411386470-- From nobody Sun Feb 12 17:23:38 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -8.886 X-Spam-Level: X-Spam-Status: No, score=-8.886 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H2=-1.887, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Date: Sun, 12 Feb 2017 17:23:33 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1486949013; bh=6M4hFw/lNSYd95+2j7FgpzkpadHyG+g94J2eSdtteHM=; h=From:Reply-To:To:Cc:In-Reply-To:References:Subject:List-ID: List-Archive:List-Post:List-Unsubscribe:From; b=WdA+G0VJhtJBcOpJWK7IUrHAFyHkVfj5RIRLVi9n10WZsxHVLXPv3aMaQB7Mlp3mZ IxrHv2/vQqxxFld3ZBujgmzpFNZozFj51FNu4JcgSdnAMhLLlrp6L3Vdn4G7bRmmyc 0KdOXjuWJWlrmQphcgEqPqiHL9sNdjaZj7pscYB4= To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] Requiring Accept-CH (#284) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_58a10a955f598_41b3fae7ad27130103155"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Feb 2017 01:23:36 -0000 ----==_mimepart_58a10a955f598_41b3fae7ad27130103155 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit @yoavweiss that User-Agent strings have, in some recent mobile implementations, increased their entropy and revealed more about the specific hardware isn't necessarily a good thing or something we should accept and duplicate in actual standards. The browser on the laptop I'm using right now doesn't reveal the specific model of MacBook that I'm using, or the size or density of its screen in the `User-Agent` or other HTTP headers. I agree that looking up info in device databases based on browser sniffing is not the ideal case; I don't think that means we should increase the presence of explicit device info in all HTTP requests. `Accept-CH` would be a data minimization method more similar to existing JavaScript implementations; sites that need the information can ask for it and ask for it in a way that's visible. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/issues/284#issuecomment-279273517 ----==_mimepart_58a10a955f598_41b3fae7ad27130103155 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable

@yoavw= eiss that User-Agent strings have, in some recent mobile implementati= ons, increased their entropy and revealed more about the specific hardwar= e isn't necessarily a good thing or something we should accept and duplic= ate in actual standards. The browser on the laptop I'm using right now do= esn't reveal the specific model of MacBook that I'm using, or the size or= density of its screen in the User-Agent or other HTTP heade= rs.

I agree that looking up info in device databases based on browser snif= fing is not the ideal case; I don't think that means we should increase t= he presence of explicit device info in all HTTP requests. Accept-CH= would be a data minimization method more similar to existing Java= Script implementations; sites that need the information can ask for it an= d ask for it in a way that's visible.

&m= dash;
You are receiving this because you are subscribed to this thre= ad.
Reply to this email directly, view it on GitHub, or mute the thread.

=
= ----==_mimepart_58a10a955f598_41b3fae7ad27130103155-- From nobody Sun Feb 12 21:20:25 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -0.402 X-Spam-Level: X-Spam-Status: No, score=-0.402 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_24=1.618, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=github.com; h=from:reply-to:to:cc:in-reply-to:references:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=n9htczpSYQNJw+XFn9Pspv2xJsI=; b=jXDOdXH/UmNhg+IS asQ+cOSpl48uxZaAKKEjXcJVW1zH77lCfGI4amgfAxzP2Xn3ZgG68xjgg7DL4OZ9 fn9csyjosjDXEG68bQ804WrAQTibuJNyGArT56OaiIk4QTHeGiMuU11xSxzSLx6b MS6bF0EyQ8wYGjbt9lRnp/AmM+0= Date: Sun, 12 Feb 2017 21:20:21 -0800 To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] DNS relaxation, smaller initial Origin Set (#285) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_58a14215a76ed_1a13fedd86f713c2048b4"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Push Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Feb 2017 05:20:25 -0000 ----==_mimepart_58a14215a76ed_1a13fedd86f713c2048b4 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit @mnot pushed 1 commit. e2083ad Note interaction with Alt-Svc. -- You are receiving this because you are subscribed to this thread. View it on GitHub: https://github.com/httpwg/http-extensions/pull/285/files/6b3b76186c3eecbeace6bbd7bbbb8a040b502006..e2083ad3938f7f335ef4051ce5edfb03259fdcd7 ----==_mimepart_58a14215a76ed_1a13fedd86f713c2048b4 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

@mnot pushed 1 commit.

  • e2083ad Note interaction with Alt-Svc.

—
You are receiving this because you are subscribed to this thread.
View it on GitHub or mute the thread.

----==_mimepart_58a14215a76ed_1a13fedd86f713c2048b4-- From nobody Sun Feb 12 21:25:29 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -7.268 X-Spam-Level: X-Spam-Status: No, score=-7.268 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_24=1.618, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H2=-1.887, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Date: Sun, 12 Feb 2017 21:25:24 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1486963524; bh=cCr0mg6lT7yrxZ0tdzJzLrRlEpCUbp5ooM8gUh9mpcU=; h=From:Reply-To:To:Cc:In-Reply-To:References:Subject:List-ID: List-Archive:List-Post:List-Unsubscribe:From; b=B0g40ADwomzyRg5NegYBamB+JG/VCJ1W4jejyTK+C0SpULsin6g+Vr9ZuVhZD3FhX K7jKz2lywVvs+OJIHhzLjqysORxvSN2pqv21N3y372zMlDI+y75chKbrvBplvp61tQ ip5YJq8q4ywgc1ABLOoBfP08Ilc3xciGW9aSve/U= To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] DNS relaxation, smaller initial Origin Set (#285) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_58a143448c09f_5d193fb7f3e4113886549"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Feb 2017 05:25:27 -0000 ----==_mimepart_58a143448c09f_5d193fb7f3e4113886549 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Merged #285. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/pull/285#event-959037297 ----==_mimepart_58a143448c09f_5d193fb7f3e4113886549 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

Merged #285.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_58a143448c09f_5d193fb7f3e4113886549-- From nobody Sun Feb 12 21:48:24 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -2.269 X-Spam-Level: X-Spam-Status: No, score=-2.269 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_24=1.618, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-1.887, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=github.com; h=from:reply-to:to:cc:in-reply-to:references:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=dz6JDFid3fQoRh23tYuX/3O6oOA=; b=YCG+PjbuMDSsC6Ba 3Fmfrpdxiyr8greW3Mvp8mVt0LPd+9ij1iOuiEkpVLFhKIy7OFMCfFv8umdaokW3 eaxEgSuy1Qz5wWISJYb017RpMrxLLAVrAC/GoXZbW1XEimQ7Vr/8fpSxm9h1f1Sf CTxQqEXXFAQJiReyBgOkHhQKmas= Date: Sun, 12 Feb 2017 21:48:20 -0800 To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] Note interaction with Alt-Svc. (e2083ad) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_58a148a42a2b1_19403fb7f3e411382819b7"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Feb 2017 05:48:23 -0000 ----==_mimepart_58a148a42a2b1_19403fb7f3e411382819b7 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit The server will include the SNI still, it's just that the SNI might not include the name for which the client is actually connecting. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/commit/e2083ad3938f7f335ef4051ce5edfb03259fdcd7#commitcomment-20854645 ----==_mimepart_58a148a42a2b1_19403fb7f3e411382819b7 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

The server will include the SNI still, it's just that the SNI might not include the name for which the client is actually connecting.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_58a148a42a2b1_19403fb7f3e411382819b7-- From nobody Mon Feb 13 03:47:01 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -0.474 X-Spam-Level: X-Spam-Status: No, score=-0.474 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_20=1.546, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=github.com; h=from:reply-to:to:cc:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=Z6RY5W7WAw99ocbi6F6E/Sq+cpE=; b=Sv65shJLeFlYgYSR GybpOT4U+1gWlroGBbhmLBoMN9tm+/Er3JSJLxyuGOomk2tXOiq7XJkf70X9e6zi uXdcsTs2AgwdTQKgRnWzVUITZEu4OGLQc6MEp2KxTJpnHOjUQ5QHj/yaNQoLx9c4 cLwyoMuAijAXT1mX4Gz4dZI+L+g= Date: Mon, 13 Feb 2017 03:46:53 -0800 To: httpwg/http-extensions Subject: [httpwg/http-extensions] clarify round-tripping of double quotes around cookie value (#295) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_58a19cad3ddb1_5da63f90a084513c291287"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Feb 2017 11:47:00 -0000 ----==_mimepart_58a19cad3ddb1_5da63f90a084513c291287 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit See discussion in -- I believe the spec needs to be clearer about this. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/issues/295 ----==_mimepart_58a19cad3ddb1_5da63f90a084513c291287 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

See discussion in https://issues.apache.org/jira/browse/HTTPCLIENT-1006 -- I believe the spec needs to be clearer about this.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_58a19cad3ddb1_5da63f90a084513c291287-- From nobody Mon Feb 13 06:49:10 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -7.482 X-Spam-Level: X-Spam-Status: No, score=-7.482 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_28=1.404, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H2=-1.887, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Date: Mon, 13 Feb 2017 06:49:06 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1486997346; bh=Gi1aFZDlGbTDa+ismdvPP0AwCBbWZ5AJtOXDtiQA/V4=; h=From:Reply-To:To:Cc:Subject:List-ID:List-Archive:List-Post: List-Unsubscribe:From; b=h9pUGfqO5DAsKKnL9sIX8LbuAlFiUgahFXWZg1ACOC9datFke8nGgUqMo4zEHigTS mH5+OI+/WvJ3GrxQR8qcFhnf7WuzR55Kg+69Hzqnu1SJDGP6NFn5vAm+Qs0VO4AeqM 0vJ1mKSmXq1la6ey4oxmmIxwpDKwyImwgjMV68t4= To: httpwg/http-extensions Subject: [httpwg/http-extensions] incorrect content length in example (#296) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_58a1c762308a3_30273f9f7f48d13c2011c1"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Feb 2017 14:49:09 -0000 ----==_mimepart_58a1c762308a3_30273f9f7f48d13c2011c1 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit header = 16 +4 + 1 +2 = 23 two records of 25 bytes = 50 sum is 73 You can view, comment on, or merge this pull request online at: https://github.com/httpwg/http-extensions/pull/296 -- Commit Summary -- * incorrect content length in example -- File Changes -- M draft-ietf-httpbis-encryption-encoding.md (2) -- Patch Links -- https://github.com/httpwg/http-extensions/pull/296.patch https://github.com/httpwg/http-extensions/pull/296.diff -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/pull/296 ----==_mimepart_58a1c762308a3_30273f9f7f48d13c2011c1 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

header = 16 +4 + 1 +2 = 23
two records of 25 bytes = 50

sum is 73

You can view, comment on, or merge this pull request online at:

  https://github.com/httpwg/http-extensions/pull/296

Commit Summary

  • incorrect content length in example

File Changes

Patch Links:

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_58a1c762308a3_30273f9f7f48d13c2011c1-- From nobody Mon Feb 13 12:58:05 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -2.269 X-Spam-Level: X-Spam-Status: No, score=-2.269 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_24=1.618, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-1.887, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=github.com; h=from:reply-to:to:cc:in-reply-to:references:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=V05JdSkeJTfuxd29o9xXebxtb7s=; b=ps3J8Is6KkW1wUJt a4c1LyFCnf961HLA2+RXYhRmX+3nmUp7ZKz05OICI8hY7navQKHZ0Hp+2bzJ2YSA Z+87GEuA3Y9F7rapSlglKT/V+Voy2pahMFqf+sntaVZ18Pk1nDNA3tIiienWN+kj UEAbYzM3BVsiqNj7aMur9nNPxZY= Date: Mon, 13 Feb 2017 12:57:59 -0800 To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] Remove Crypto-Key header field (#273) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_58a21dd785232_239a3fb5a435b1347067e"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Feb 2017 20:58:04 -0000 ----==_mimepart_58a21dd785232_239a3fb5a435b1347067e Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit @martinthomson Late to the party, but...for Web Push, am I understanding correctly that this is now included in the ECE header (idlen = 65, keyid = sender public key)? -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/pull/273#issuecomment-279519924 ----==_mimepart_58a21dd785232_239a3fb5a435b1347067e Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

@martinthomson Late to the party, but...for Web Push, am I understanding correctly that this is now included in the ECE header (idlen = 65, keyid = sender public key)?

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_58a21dd785232_239a3fb5a435b1347067e-- From nobody Mon Feb 13 14:43:54 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -1.174 X-Spam-Level: X-Spam-Status: No, score=-1.174 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_20=1.546, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=github.com; h=from:reply-to:to:cc:in-reply-to:references:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=jYnO7ZwDMIrYGabSKbAeKKqlg9w=; b=lveSC85SkqDMOKz7 OFJrBPCs/l4oko6oJ6jwq3iGFSBaRXOiGRNAlNiKHSjvZPNsq8AgRT64HtSvszWB SmbKwcod77XfwcWH9XNUSoPzkCswePe92snnMJ5kqs3AUp1ANm0TM+Tk8TdZshC9 NCeufd2tWa6fokUak8nZTbK2Cko= Date: Mon, 13 Feb 2017 14:43:46 -0800 To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] Remove Crypto-Key header field (#273) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_58a236a236489_74513fbc8287f1302082cd"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Feb 2017 22:43:54 -0000 ----==_mimepart_58a236a236489_74513fbc8287f1302082cd Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit @kitcambridge yep, that's it. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/pull/273#issuecomment-279547960 ----==_mimepart_58a236a236489_74513fbc8287f1302082cd Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

@kitcambridge yep, that's it.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_58a236a236489_74513fbc8287f1302082cd-- From nobody Mon Feb 13 14:44:20 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -4.569 X-Spam-Level: X-Spam-Status: No, score=-4.569 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_24=1.618, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H2=-1.887, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=github.com; h=from:reply-to:to:cc:in-reply-to:references:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=BZniJoEFtqnNC3cc6yishi/pnbs=; b=Bhty+KwhhIyNCKVf IkyEQJq2306zLETJWGIgPPO2o+uIln7cjXDZKI7aY0ajnd7TOVlj8T/j3sM1R3TE 1wUByT9NQqVNEqGTshRgGgzvBXzr/UvMDhQxo27cTsUuNzLlCRwCwsNo0oHuc/Aj rlrHYp40DrPQMaQkEJ2CD8XfczY= Date: Mon, 13 Feb 2017 14:44:12 -0800 To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] incorrect content length in example (#296) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_58a236bcceb8d_a533fc7c331313c2430f1"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Feb 2017 22:44:19 -0000 ----==_mimepart_58a236bcceb8d_a533fc7c331313c2430f1 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Merged #296. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/pull/296#event-960472184 ----==_mimepart_58a236bcceb8d_a533fc7c331313c2430f1 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

Merged #296.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_58a236bcceb8d_a533fc7c331313c2430f1-- From nobody Wed Feb 15 15:29:47 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -7.482 X-Spam-Level: X-Spam-Status: No, score=-7.482 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_28=1.404, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H2=-1.887, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Date: Wed, 15 Feb 2017 15:29:42 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1487201382; bh=riSITjvmmbLQgCRUVFCw8YGRH17Z2DuhQNYYfjwDbhU=; h=From:Reply-To:To:Cc:Subject:List-ID:List-Archive:List-Post: List-Unsubscribe:From; b=F+1/da3JZsPweqMgAx9XNUgGjlwhw6jAqqLLQYSFZiEOJj56g/Rqx3Llg3hSkXM2E jcM9DVuJpr/1TEzYNTvguHoIPUT2pwhX5vMuVBOrFaVgkt6deIAPPq3MdRCsp8nI8T 1N05JE+EEAmCFJS7GQ5jOS8VgvtFL8uizMshR7DA= To: httpwg/http-extensions Subject: [httpwg/http-extensions] Updated Opp-Sec writeup (#297) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_58a4e46675bd3_78a73f969d19d13813015f"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 15 Feb 2017 23:29:45 -0000 ----==_mimepart_58a4e46675bd3_78a73f969d19d13813015f Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit For git tracking purposes, even though I'm uploading directly to Datatracker as well. You can view, comment on, or merge this pull request online at: https://github.com/httpwg/http-extensions/pull/297 -- Commit Summary -- * Updated Opp-Sec writeup -- File Changes -- M writeups/opp-sec.md (104) -- Patch Links -- https://github.com/httpwg/http-extensions/pull/297.patch https://github.com/httpwg/http-extensions/pull/297.diff -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/pull/297 ----==_mimepart_58a4e46675bd3_78a73f969d19d13813015f Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

For git tracking purposes, even though I'm uploading directly to Datatracker as well.

You can view, comment on, or merge this pull request online at:

  https://github.com/httpwg/http-extensions/pull/297

Commit Summary

  • Updated Opp-Sec writeup

File Changes

Patch Links:

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_58a4e46675bd3_78a73f969d19d13813015f-- From nobody Wed Feb 15 16:11:42 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -6.186 X-Spam-Level: X-Spam-Status: No, score=-6.186 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_32=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H2=-1.887, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=github.com; h=from:reply-to:to:cc:in-reply-to:references:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=vKSZpyOqoPshM+uSSw+FHRyawC0=; b=aVN9Cy8LX9EHDWDC jn5e/tVvacmmb4Qi02gLg7bsgotgR4QCthgSNJp2e9VtIBhxATDmzOb7RE0dJex4 ejaUosXVRoULucmt8+dURc3TQiUmNyeH5EhFsz55VRfHzoNarD+U9xF/6Mjhg7PA +3p1slGUqcc2CEZPtIYffE1rVVA= Date: Wed, 15 Feb 2017 16:11:37 -0800 To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] Updated Opp-Sec writeup (#297) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_58a4ee391e19_c493f997abad134359dd"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 16 Feb 2017 00:11:41 -0000 ----==_mimepart_58a4ee391e19_c493f997abad134359dd Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit martinthomson commented on this pull request. > + +RFC 7838 requires "reasonable assurances" that the alternative was under the +control of the same authority as the origin. RFC 7838 defines only one means of +having such assurance: possession of a TLS certificate for the origin. After +much discussion, this draft maintains that definition and requires the use of +fully verified certificates. + +The other item of particular concern around using RFC7838 with http:// URIs was +server support for receiving requests for http:// schemed resources on ports +configured to use TLS. While HTTP/1.1 might permit and HTTP/2 mandates the +inclusion of the URL scheme with the request, it appears that almost no server +implementations treat the included scheme as more authoritative than the port on +which it was received. This is noted in section 4.4. As a result, the final +version of this document prohibits the use of HTTP/1.1 and uses the .well-known +resource as a server's self-certification that it can correctly distinguish such +requests. You might also note the added prohibition on "coalescing". -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/pull/297#pullrequestreview-22145044 ----==_mimepart_58a4ee391e19_c493f997abad134359dd Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

@martinthomson commented on this pull request.

In writeups/opp-sec.md:

> +
+RFC 7838 requires "reasonable assurances" that the alternative was under the
+control of the same authority as the origin. RFC 7838 defines only one means of
+having such assurance: possession of a TLS certificate for the origin. After
+much discussion, this draft maintains that definition and requires the use of
+fully verified certificates.
+
+The other item of particular concern around using RFC7838 with http:// URIs was
+server support for receiving requests for http:// schemed resources on ports
+configured to use TLS. While HTTP/1.1 might permit and HTTP/2 mandates the
+inclusion of the URL scheme with the request, it appears that almost no server
+implementations treat the included scheme as more authoritative than the port on
+which it was received. This is noted in section 4.4. As a result, the final
+version of this document prohibits the use of HTTP/1.1 and uses the .well-known
+resource as a server's self-certification that it can correctly distinguish such
+requests.

You might also note the added prohibition on "coalescing".

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_58a4ee391e19_c493f997abad134359dd-- From nobody Sun Feb 19 10:17:41 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -7.482 X-Spam-Level: X-Spam-Status: No, score=-7.482 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_28=1.404, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H2=-1.887, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Date: Sun, 19 Feb 2017 10:17:35 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1487528255; bh=UIIhstECk1y2WR9ABitRUP8Hz037UNKYvii9JVHAAF0=; h=From:Reply-To:To:Cc:Subject:List-ID:List-Archive:List-Post: List-Unsubscribe:From; b=aRE9v6px46f1DLrM0rRG4mATO8ENyMrMYARMbMXXRlj9HwQ1/AYaEouXIApN1wRPj sn67n74l4SpIwT+rR5ith97iYbonx8xU2a2knkeUnglq4OB0XbXIvV776C7xv96lpF bjjx1ZiUhaUwo1whnZwW83ihdQ7S9KFgUTb2cwcs= To: httpwg/http-extensions Subject: [httpwg/http-extensions] align the descriptions (#298) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_58a9e13fb9d93_6c33fb21949313427812"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 19 Feb 2017 18:17:39 -0000 ----==_mimepart_58a9e13fb9d93_6c33fb21949313427812 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit You can view, comment on, or merge this pull request online at: https://github.com/httpwg/http-extensions/pull/298 -- Commit Summary -- * align the descriptions -- File Changes -- M draft-ietf-httpbis-encryption-encoding.md (10) -- Patch Links -- https://github.com/httpwg/http-extensions/pull/298.patch https://github.com/httpwg/http-extensions/pull/298.diff -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/pull/298 ----==_mimepart_58a9e13fb9d93_6c33fb21949313427812 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

You can view, comment on, or merge this pull request online at:

  https://github.com/httpwg/http-extensions/pull/298

Commit Summary

  • align the descriptions

File Changes

Patch Links:

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_58a9e13fb9d93_6c33fb21949313427812-- From nobody Sun Feb 19 10:33:50 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -7.482 X-Spam-Level: X-Spam-Status: No, score=-7.482 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_28=1.404, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H2=-1.887, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Date: Sun, 19 Feb 2017 10:33:46 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1487529226; bh=NA2uEhRsVSo6qHCX60z+EvuKQFc5SVDglspHpkEDGJk=; h=From:Reply-To:To:Cc:Subject:List-ID:List-Archive:List-Post: List-Unsubscribe:From; b=ax1iGML/sDsVGBewVSSnZpkLJY0PuMIRbbbRbVqhAB3APO9QL1Jore4HSbKkMptDY UuKPoVDZV/n0DQ/nk3aivlG7EKWPVU04OxYrxnGshjVRFAfQCDv0gfpFbDrhmNfW/k GM5SUcEsvlSszrjTyEuse7Kp0wl9iqrZVeUd7vXo= To: httpwg/http-extensions Subject: [httpwg/http-extensions] update FIPS180-4 reference (#299) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_58a9e50a9b347_701c3ff8bd1b5134551ec"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 19 Feb 2017 18:33:49 -0000 ----==_mimepart_58a9e50a9b347_701c3ff8bd1b5134551ec Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit You can view, comment on, or merge this pull request online at: https://github.com/httpwg/http-extensions/pull/299 -- Commit Summary -- * update FIPS180-4 reference -- File Changes -- M draft-ietf-httpbis-encryption-encoding.md (5) -- Patch Links -- https://github.com/httpwg/http-extensions/pull/299.patch https://github.com/httpwg/http-extensions/pull/299.diff -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/pull/299 ----==_mimepart_58a9e50a9b347_701c3ff8bd1b5134551ec Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

You can view, comment on, or merge this pull request online at:

  https://github.com/httpwg/http-extensions/pull/299

Commit Summary

  • update FIPS180-4 reference

File Changes

Patch Links:

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_58a9e50a9b347_701c3ff8bd1b5134551ec-- From nobody Sun Feb 19 10:43:23 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -4.569 X-Spam-Level: X-Spam-Status: No, score=-4.569 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_24=1.618, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H2=-1.887, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=github.com; h=from:reply-to:to:cc:in-reply-to:references:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=bEiDPIczQuDB8NcnEM4HJp7HwMM=; b=HrVxYOzVBXvebXLB nB3JVHkp9J63FEgWJvEPJi2aac/Zv/g6gR+6IrgMSQHsXBACLX8d/qnyrND5PfEA NxuNSGYOtmEr/Wws28l0XVnpgDFEZlJcm+42aYxvbZmf1KBKojBaV9JY9WC9Po2r J8bIZV0YMwQLOlgQC1anzDP80us= Date: Sun, 19 Feb 2017 10:43:19 -0800 To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] Explain why aesgcm doesn't need a dummy parameter (6880580) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_58a9e747e8835_3ffa3f94887fb1408558a"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 19 Feb 2017 18:43:23 -0000 ----==_mimepart_58a9e747e8835_3ffa3f94887fb1408558a Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit In XML, this yields: \ Note the empty value; can this be fixed somehow? cc: @martinthomson -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/commit/68805802f00ea90b84a3e62c75241556d4b6e4d6#commitcomment-20950582 ----==_mimepart_58a9e747e8835_3ffa3f94887fb1408558a Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable

In XML, this yields:

<seriesInfo name=3D"W3C Recommendation REC-xmlenc-core1-20130411" val= ue=3D""/>

Note the empty value; can this be fixed somehow?

cc: = @martinthomson

&mda= sh;
You are receiving this because you are subscribed to this thread.<= br />Reply to this email directly, view it on GitHub, or mute the thread.3D""

= ----==_mimepart_58a9e747e8835_3ffa3f94887fb1408558a-- From nobody Sun Feb 19 10:46:47 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -2.483 X-Spam-Level: X-Spam-Status: No, score=-2.483 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_28=1.404, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-1.887, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=github.com; h=from:reply-to:to:cc:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=5o583XZ6fNshue7HTfYyUgeTEs8=; b=QyWgyXHHu4oAu0Um kmZKRlgqT7oY0uNHT1DtikVt4tCsar3MtEsWGulAkm5n/zZvVFnCKDD137iegbf4 /rdYyUTtSKQNtWMggVw+/qZkFcJ8FutUGnuWtItPaMULmBO2lUlcoMoXW41KatoV Tg29yYCjdFlKMslgOFdV5JhryYk= Date: Sun, 19 Feb 2017 10:46:40 -0800 To: httpwg/http-extensions Subject: [httpwg/http-extensions] fix series info for XMLENC (#300) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_58a9e810b91c1_5e0f3fa90600d130689ef"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 19 Feb 2017 18:46:46 -0000 ----==_mimepart_58a9e810b91c1_5e0f3fa90600d130689ef Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit You can view, comment on, or merge this pull request online at: https://github.com/httpwg/http-extensions/pull/300 -- Commit Summary -- * fix series info for XMLENC -- File Changes -- M draft-ietf-httpbis-encryption-encoding.md (3) -- Patch Links -- https://github.com/httpwg/http-extensions/pull/300.patch https://github.com/httpwg/http-extensions/pull/300.diff -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/pull/300 ----==_mimepart_58a9e810b91c1_5e0f3fa90600d130689ef Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

You can view, comment on, or merge this pull request online at:

  https://github.com/httpwg/http-extensions/pull/300

Commit Summary

  • fix series info for XMLENC

File Changes

Patch Links:

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_58a9e810b91c1_5e0f3fa90600d130689ef-- From nobody Sun Feb 19 14:35:59 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -7.268 X-Spam-Level: X-Spam-Status: No, score=-7.268 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_24=1.618, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H2=-1.887, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Date: Sun, 19 Feb 2017 14:35:55 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1487543755; bh=FyUwbURqn1Up+ZoFtwDIE+UAJUFf6FIs/6kwtuP8rN8=; h=From:Reply-To:To:Cc:In-Reply-To:References:Subject:List-ID: List-Archive:List-Post:List-Unsubscribe:From; b=lozdQ0SN3zevM/Su7wy4JSjOzOF+r07OfD5Ef/MAtGGq/z3RmyfROAUaSjwOG7F7N RnAuXitEOGUwjF38vPy2tzN1gpfXoEwBYM2yvDm2t4tvIm6b938pGG+ZpF+6FIXKyu KgGfM1YouzFzmI7F5+gIJtccbeURIS/PoHFm1TRY= To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] align the descriptions (#298) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_58aa1dcb8d1c_1cb3fab8660513c32039a"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 19 Feb 2017 22:35:58 -0000 ----==_mimepart_58aa1dcb8d1c_1cb3fab8660513c32039a Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Merged #298. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/pull/298#event-968473807 ----==_mimepart_58aa1dcb8d1c_1cb3fab8660513c32039a Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

Merged #298.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_58aa1dcb8d1c_1cb3fab8660513c32039a-- From nobody Sun Feb 19 14:36:18 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -1.102 X-Spam-Level: X-Spam-Status: No, score=-1.102 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_24=1.618, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=github.com; h=from:reply-to:to:cc:in-reply-to:references:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=QI+oR+QnpmqNF30gT4pj7CrTwXY=; b=bJmH6aZ1F4ykkYrZ DoGbkItBoT9K3xp+zCGNulRZuyPE7Kz+aiTzobWczeCmX/9J0mVUkjailIJjedA1 Vw80lafaXVXgFIy8NbZ7ohbO6tLx2yBjzm0ephYmhb1t9nHLqrqM7tS/2gZB75iO KpR5Uq6oQWcDczKrVFy+xLygr+8= Date: Sun, 19 Feb 2017 14:36:14 -0800 To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] update FIPS180-4 reference (#299) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_58aa1dde80a1c_d9c3fe3a4a331404208f"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 19 Feb 2017 22:36:17 -0000 ----==_mimepart_58aa1dde80a1c_d9c3fe3a4a331404208f Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Merged #299. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/pull/299#event-968473925 ----==_mimepart_58aa1dde80a1c_d9c3fe3a4a331404208f Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

Merged #299.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_58aa1dde80a1c_d9c3fe3a4a331404208f-- From nobody Sun Feb 19 14:36:58 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -4.569 X-Spam-Level: X-Spam-Status: No, score=-4.569 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_24=1.618, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H2=-1.887, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=github.com; h=from:reply-to:to:cc:in-reply-to:references:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=evx6EK79uOlNXohgB2mDJLyl4BQ=; b=UV+N5anNbcOOnzo3 2utuvefK1FaSdTZE3p9jB39MPA2FHmD15KcPXmfW2LoFkOqLmLcGtK+OFX+4G6vn o6F1SiyNEasqF/RFij+yiSjOpx/H7ceVMz9bPbLuF0TnODClJR12kIDfZpUIqt0u itutfsFaVdu8GeR44z5xPWsgRLM= Date: Sun, 19 Feb 2017 14:36:54 -0800 To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] fix series info for XMLENC (#300) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_58aa1e061b4dd_e4b3f88e461f13c12284"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 19 Feb 2017 22:36:57 -0000 ----==_mimepart_58aa1e061b4dd_e4b3f88e461f13c12284 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Merged #300. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/pull/300#event-968474110 ----==_mimepart_58aa1e061b4dd_e4b3f88e461f13c12284 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

Merged #300.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_58aa1e061b4dd_e4b3f88e461f13c12284-- From nobody Sun Feb 19 14:38:17 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -0.402 X-Spam-Level: X-Spam-Status: No, score=-0.402 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_24=1.618, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=github.com; h=from:reply-to:to:cc:in-reply-to:references:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=fw22ilESA434mpf9wEEe6pcasr4=; b=DvRHOdpXVUbaopiW eSQJiXGKAi6T8eMH/2U1pBUzH7+2YTic8kt/837AaNPAc/+IanbRvZeKHahrx27u USIyj1QdFv97ZduT85mm4YS4IqvCYfW0+pfhjwbDI4UKLM05KvgjToruX2ovqkwH g5iCFLiyB+QUVGq1cnKouGufP68= Date: Sun, 19 Feb 2017 14:38:12 -0800 To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] Explain why aesgcm doesn't need a dummy parameter (6880580) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_58aa1e54dc1fb_7fc93fab8660513c195295"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 19 Feb 2017 22:38:15 -0000 ----==_mimepart_58aa1e54dc1fb_7fc93fab8660513c195295 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit I see that you managed to work out how to fix this. This a very badly documented piece of code, so I'm always left guessing. I would never have guessed your solution. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/commit/68805802f00ea90b84a3e62c75241556d4b6e4d6#commitcomment-20951700 ----==_mimepart_58aa1e54dc1fb_7fc93fab8660513c195295 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable

I see that you managed to work out how to fix this. This a very badly d= ocumented piece of code, so I'm always left guessing. I would never have g= uessed your solution.

&mda= sh;
You are receiving this because you are subscribed to this thread.<= br />Reply to this email directly, view it on GitHub, or mute the thread.3D""

= ----==_mimepart_58aa1e54dc1fb_7fc93fab8660513c195295-- From nobody Mon Feb 20 16:55:57 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -4.783 X-Spam-Level: X-Spam-Status: No, score=-4.783 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_28=1.404, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H2=-1.887, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=github.com; h=from:reply-to:to:cc:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=3uUEnEbWkTPce57oQO8rXeF0QxA=; b=MDalhp2THDCdVXgT 5W0sPTRhP3ObFu0zO7xD0qOnyn1Fu3lj/syocAE3j0bvPByADwooGQc/dIPP8h44 tj7lk39ajZybDT3U2x/p6Yj2YdKnBIAECKTx2TRFzJbMkoULbME9I8F5WjECo56T nuvUxvhlrRt1k862Y444KVEzkTY= Date: Mon, 20 Feb 2017 16:55:33 -0800 To: httpwg/http-extensions Subject: [httpwg/http-extensions] Make the intro to http2-encryption clearer about the scope (#301) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_58ab900575b54_7b893fa1df419130109654"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Feb 2017 00:55:57 -0000 ----==_mimepart_58ab900575b54_7b893fa1df419130109654 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit You can view, comment on, or merge this pull request online at: https://github.com/httpwg/http-extensions/pull/301 -- Commit Summary -- * Make the intro to http2-encryption clearer about the scope -- File Changes -- M draft-ietf-httpbis-http2-encryption.md (20) -- Patch Links -- https://github.com/httpwg/http-extensions/pull/301.patch https://github.com/httpwg/http-extensions/pull/301.diff -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/pull/301 ----==_mimepart_58ab900575b54_7b893fa1df419130109654 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

You can view, comment on, or merge this pull request online at:

  https://github.com/httpwg/http-extensions/pull/301

Commit Summary

  • Make the intro to http2-encryption clearer about the scope

File Changes

Patch Links:

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_58ab900575b54_7b893fa1df419130109654-- From nobody Mon Feb 20 16:59:37 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -6.999 X-Spam-Level: X-Spam-Status: No, score=-6.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Date: Mon, 20 Feb 2017 16:59:32 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1487638772; bh=4w1+Lou/KNgw6DGEZIKbHZ9KPdKZMehxC02x+YgWdVc=; h=From:Reply-To:To:Cc:In-Reply-To:References:Subject:List-ID: List-Archive:List-Post:List-Unsubscribe:From; b=qy13rg5rTGqgsFeqzyss4Kfsb+rJfFYummot1rozrSB0SOFYIVJe4aGMnjDArGJ00 HhBbPody9LY9NW6i43qUvT7iL4ZGpheru8HdcJhfrM2Jjw7lZ0iHwTx6E0m3nsaJxR njpl4nlL7/TBmoLlHIf0T5rY6S8qVjaK8BWtoDyo= To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] Make the intro to http2-encryption clearer about the scope (#301) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_58ab90f4c7f37_47543f87366dd13c244229"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Feb 2017 00:59:37 -0000 ----==_mimepart_58ab90f4c7f37_47543f87366dd13c244229 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit mnot requested changes on this pull request. Looks pretty good to me, some tweaks here. > passive attacks. -Opportunistic Security {{RFC7435}} does not provide the same guarantees as using TLS with `https` -URIs; it is vulnerable to active attacks, and does not change the security context of the +Opportunistic Security does not provide the same guarantees as using TLS with `https` +URIs; Opportunistic Security is vulnerable to active attacks, and does not change the security context of the I think this would read more clearly if it were just "...URIs, because it is vulnerable..." > @@ -64,16 +64,18 @@ for this draft can be found at @@ -64,16 +64,18 @@ for this draft can be found at @@ -48,7 +48,7 @@ informative: --- abstract -This document describes how `http` URIs can be accessed using Transport Layer Security (TLS) to +This document describes how `http` URIs can be accessed using Transport Layer Security (TLS) in HTTP/2 to in -> and -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/pull/301#pullrequestreview-22859928 ----==_mimepart_58ab90f4c7f37_47543f87366dd13c244229 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

@mnot requested changes on this pull request.

Looks pretty good to me, some tweaks here.

In draft-ietf-httpbis-http2-encryption.md:

>  passive attacks.
 
-Opportunistic Security {{RFC7435}} does not provide the same guarantees as using TLS with `https`
-URIs; it is vulnerable to active attacks, and does not change the security context of the
+Opportunistic Security does not provide the same guarantees as using TLS with `https`
+URIs; Opportunistic Security is vulnerable to active attacks, and does not change the security context of the

I think this would read more clearly if it were just "...URIs, because it is vulnerable..."

In draft-ietf-httpbis-http2-encryption.md:

> @@ -64,16 +64,18 @@ for this draft can be found at <https://github.com/httpwg/http-extensions/labels
 # Introduction
 
 This document describes a use of HTTP Alternative Services {{RFC7838}} to decouple
-the URI scheme from the use and configuration of underlying encryption, allowing a `http` URI
-{{RFC7230}} to be accessed using Transport Layer Security (TLS) {{RFC5246}} opportunistically.
-
-Serving `https` URIs requires avoiding Mixed Content {{W3C.CR-mixed-content-20160802}}, which is
-problematic in many deployments. This document describes a usage model whereby sites can serve
-`http` URIs over TLS, thereby avoiding these issues, while still providing protection against
+the URI scheme from the use and configuration of underlying encryption.
+It allows HTTP/2 {{RFC7540}} to access a `http` URI
+{{RFC7230}} using Transport Layer Security (TLS) {{RFC5246}}
+with Opportunistic Security {{RFC7435}}.
+
+This document describes a usage model whereby sites can serve
+`http` URIs over TLS, thereby avoiding the problem of serving 
+Mixed Content (describe in {{W3C.CR-mixed-content-20160802}}) while still providing protection against

described

In draft-ietf-httpbis-http2-encryption.md:

> @@ -64,16 +64,18 @@ for this draft can be found at <https://github.com/httpwg/http-extensions/labels
 # Introduction
 
 This document describes a use of HTTP Alternative Services {{RFC7838}} to decouple
-the URI scheme from the use and configuration of underlying encryption, allowing a `http` URI
-{{RFC7230}} to be accessed using Transport Layer Security (TLS) {{RFC5246}} opportunistically.
-
-Serving `https` URIs requires avoiding Mixed Content {{W3C.CR-mixed-content-20160802}}, which is
-problematic in many deployments. This document describes a usage model whereby sites can serve
-`http` URIs over TLS, thereby avoiding these issues, while still providing protection against
+the URI scheme from the use and configuration of underlying encryption.
+It allows HTTP/2 {{RFC7540}} to access a `http` URI

This is worded oddly. Suggest "It allows a http URI to be accessed using HTTP/2 {{RFC7230}} and Transport Layer..."

In draft-ietf-httpbis-http2-encryption.md:

> @@ -48,7 +48,7 @@ informative:
 
 --- abstract
 
-This document describes how `http` URIs can be accessed using Transport Layer Security (TLS) to
+This document describes how `http` URIs can be accessed using Transport Layer Security (TLS) in HTTP/2 to

in -> and

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_58ab90f4c7f37_47543f87366dd13c244229-- From nobody Mon Feb 20 17:00:24 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -0.474 X-Spam-Level: X-Spam-Status: No, score=-0.474 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_20=1.546, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=github.com; h=from:reply-to:to:cc:in-reply-to:references:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=VBnVZWpZpCYKzFd/AxYrKqFj3FY=; b=OlQJMw6YElQka9bK WVKxMs7e7J3JPeK62eYJwvtkBR/9UcrW6etXyy5Adom720QGJbcTgHg8TYwytsYU BIfjlJ32m5Z31JMQJps+LsnaNSe8gIJ1WPKwcgeC/ns1oQCp+Mnm7v6C+b8bar8D fXXlfUg9GPczBbjeZdNPbTuYmjI= Date: Mon, 20 Feb 2017 17:00:11 -0800 To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] Make the intro to http2-encryption clearer about the scope (#301) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_58ab911b2e28f_186f3fb125f01138420158"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Feb 2017 01:00:23 -0000 ----==_mimepart_58ab911b2e28f_186f3fb125f01138420158 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit @martinthomson thoughts? -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/pull/301#issuecomment-281216234 ----==_mimepart_58ab911b2e28f_186f3fb125f01138420158 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

@martinthomson thoughts?

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_58ab911b2e28f_186f3fb125f01138420158-- From nobody Mon Feb 20 17:01:10 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -6.982 X-Spam-Level: X-Spam-Status: No, score=-6.982 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_28=1.404, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H2=-1.887, RCVD_IN_SORBS_SPAM=0.5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Date: Mon, 20 Feb 2017 17:01:06 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1487638866; bh=8Z61FuXdwmTuTuk4/ZMcUji82A+hN62c6gcMfb2ir4s=; h=From:Reply-To:To:Cc:In-Reply-To:References:Subject:List-ID: List-Archive:List-Post:List-Unsubscribe:From; b=aMB6ML5BVgvtVcoPQqaSXOgKoFPOUNyvuJJ9njiYjxIalcbam5HPRNTT34wJ+DGRe ym571cXt9QNbK40hc4SdJMXh8jCXeXKqO2L1NfNcPWs15a791Z8oZsFk9QitAevDp1 9oguPOJ1HVEC54xWcHZM3iTLiYuotRchFsop6aaY= To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] Make the intro to http2-encryption clearer about the scope (#301) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_58ab91522eb2b_3d5e3f87366dd13c210763"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Feb 2017 01:01:09 -0000 ----==_mimepart_58ab91522eb2b_3d5e3f87366dd13c210763 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit paulehoffman commented on this pull request. > passive attacks. -Opportunistic Security {{RFC7435}} does not provide the same guarantees as using TLS with `https` -URIs; it is vulnerable to active attacks, and does not change the security context of the +Opportunistic Security does not provide the same guarantees as using TLS with `https` +URIs; Opportunistic Security is vulnerable to active attacks, and does not change the security context of the WFM -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/pull/301#discussion_r102114637 ----==_mimepart_58ab91522eb2b_3d5e3f87366dd13c210763 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

@paulehoffman commented on this pull request.

In draft-ietf-httpbis-http2-encryption.md:

>  passive attacks.
 
-Opportunistic Security {{RFC7435}} does not provide the same guarantees as using TLS with `https`
-URIs; it is vulnerable to active attacks, and does not change the security context of the
+Opportunistic Security does not provide the same guarantees as using TLS with `https`
+URIs; Opportunistic Security is vulnerable to active attacks, and does not change the security context of the

WFM

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_58ab91522eb2b_3d5e3f87366dd13c210763-- From nobody Mon Feb 20 17:09:58 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -2.019 X-Spam-Level: X-Spam-Status: No, score=-2.019 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_32=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=github.com; h=from:reply-to:to:cc:in-reply-to:references:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=7H5EL3mCLGCfMjNfhsEgdoEoCnc=; b=E0CMgA5tmWxVAM7f 9WKumukc4Mg2hIPYim/WidqU6Go3okzFwb07j/bn2ZWrokUC5MyShQa6IzuMkNj5 VsWAMLZT3U/xKRf5blJt5Gwl633Rt2HMD58ZRZuZ/QPWkQDU0GGCW1x3k1nOsfY3 vJCBTO727vPHExUMw4dB7vGKpuA= Date: Mon, 20 Feb 2017 17:09:28 -0800 To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] Make the intro to http2-encryption clearer about the scope (#301) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_58ab9348b394b_780a3f87366dd13c238314"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Feb 2017 01:09:56 -0000 ----==_mimepart_58ab9348b394b_780a3f87366dd13c238314 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit martinthomson commented on this pull request. > @@ -64,16 +64,18 @@ for this draft can be found at @martinthomson commented on this pull request.

In draft-ietf-httpbis-http2-encryption.md:

> @@ -64,16 +64,18 @@ for this draft can be found at <https://github.com/httpwg/http-extensions/labels
 # Introduction
 
 This document describes a use of HTTP Alternative Services {{RFC7838}} to decouple
-the URI scheme from the use and configuration of underlying encryption, allowing a `http` URI
-{{RFC7230}} to be accessed using Transport Layer Security (TLS) {{RFC5246}} opportunistically.
-
-Serving `https` URIs requires avoiding Mixed Content {{W3C.CR-mixed-content-20160802}}, which is
-problematic in many deployments. This document describes a usage model whereby sites can serve
-`http` URIs over TLS, thereby avoiding these issues, while still providing protection against
+the URI scheme from the use and configuration of underlying encryption.
+It allows HTTP/2 {{RFC7540}} to access a `http` URI

"a" or "an" for "http"?

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_58ab9348b394b_780a3f87366dd13c238314-- From nobody Mon Feb 20 17:20:31 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -0.474 X-Spam-Level: X-Spam-Status: No, score=-0.474 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_20=1.546, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=github.com; h=from:reply-to:to:cc:in-reply-to:references:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=EeZr1cMTS57lf5pa92fk0V32QSM=; b=l7Tk6NEhTF8vSX6e ozxKSaRTvZj31yP54ULq50nQzX5LPOX6XHnF+ydLIE7CWkkBE8a+iYXixdgrIJBE HcOIL86H/nCJGog8dUSjoIQWCbsCTjYwtBscy7LDYJlRPHsv7Fsdct2Npq6sUyci yroAD653ffliuYArUCARIJz1b1Y= Date: Mon, 20 Feb 2017 17:20:27 -0800 To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] Make the intro to http2-encryption clearer about the scope (#301) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_58ab95db7a073_1ba73fa37734f134237255"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Feb 2017 01:20:30 -0000 ----==_mimepart_58ab95db7a073_1ba73fa37734f134237255 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Seems fine, with the edits Mark suggested. I'll merge and make those changes unless Paul gets to it first. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/pull/301#issuecomment-281218741 ----==_mimepart_58ab95db7a073_1ba73fa37734f134237255 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

Seems fine, with the edits Mark suggested. I'll merge and make those changes unless Paul gets to it first.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_58ab95db7a073_1ba73fa37734f134237255-- From nobody Mon Feb 20 18:42:56 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -4.569 X-Spam-Level: X-Spam-Status: No, score=-4.569 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_24=1.618, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H2=-1.887, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=github.com; h=from:reply-to:to:cc:in-reply-to:references:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=mnbwPjNxIgfji7oR9PnWIoS5lPs=; b=lHLyP/bgSYjqyRYf +6UBRgpU6RBGlwEVG2qH2ahKl7wg+xaWVjceoSROr4k146zHBjFq9V0rjFBhpa/s EPfn78cc9OXjzGCmQ6u+obpKfnEAxaFvgCO2KmEmOSMnh8WwHDV0O6e9fiGklakO n3v9zDcfOLyFkqfA9jQpG+nHXqk= Date: Mon, 20 Feb 2017 18:42:51 -0800 To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] Make the intro to http2-encryption clearer about the scope (#301) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_58aba92b987ee_503d3f8c6a35713c38081"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Feb 2017 02:42:54 -0000 ----==_mimepart_58aba92b987ee_503d3f8c6a35713c38081 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Merged #301. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/pull/301#event-970036522 ----==_mimepart_58aba92b987ee_503d3f8c6a35713c38081 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

Merged #301.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_58aba92b987ee_503d3f8c6a35713c38081-- From nobody Wed Feb 22 15:49:34 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -0.403 X-Spam-Level: X-Spam-Status: No, score=-0.403 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_24=1.618, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=github.com; h=from:reply-to:to:cc:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=ZzWfJgior4IhcXYul6tRtTzVNYc=; b=liIi8tFjVRdvSQal 5Wc806I9nFKmLfp57dI3AzPjdqwAi+xV+UklKbBnn9VEzG+1s2esvw9kfSx0NuN6 /e9KkEb7o4roDY627DQkKYMhhnfCJ+9tnOq9b5J9iNMOA0U9hAXZ3bQgVvYvwOdN +oaOQC21Od5hof8qo1tbJDx2pbY= Date: Wed, 22 Feb 2017 15:49:31 -0800 To: httpwg/http-extensions Subject: [httpwg/http-extensions] Typo in SameSite cookie algorithm (?) (#302) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_58ae238b4efdb_19073fa36f1e5c38100724"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Feb 2017 23:49:34 -0000 ----==_mimepart_58ae238b4efdb_19073fa36f1e5c38100724 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Step 5 of Section 2.1.1 of https://tools.ietf.org/html/draft-ietf-httpbis-cookie-same-site-00#section-2.1.1 says `return "top-site"`, but "top-site" isn't defined anywhere. I think it's supposed to be the registerable domain of "top-origin"? cc @scotthelme -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/issues/302 ----==_mimepart_58ae238b4efdb_19073fa36f1e5c38100724 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

Step 5 of Section 2.1.1 of https://tools.ietf.org/html/draft-ietf-httpbis-cookie-same-site-00#section-2.1.1 says return "top-site", but "top-site" isn't defined anywhere. I think it's supposed to be the registerable domain of "top-origin"?

cc @scotthelme

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_58ae238b4efdb_19073fa36f1e5c38100724-- From nobody Fri Feb 24 06:17:21 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -0.403 X-Spam-Level: X-Spam-Status: No, score=-0.403 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_24=1.618, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=github.com; h=from:reply-to:to:cc:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=3bEqJWDdH4coxxpyi64y4arvFlo=; b=XHYmPfWSOXz3/M8H GxcxeZ+fowRiO3NUxLHhSxMMEP332LzVmW5AuMpKRtXp+5mRrlmR5PBdmgf+N1oU 9wzZwGPa6gIINo7hEfp8HZ4x7cSNfF9apTD29z4H+of9TG/GCcD2VgSQLBG6ROlX +sKrH7pq42HFcXbxku+NA3Hz2dY= Date: Fri, 24 Feb 2017 06:17:15 -0800 To: httpwg/http-extensions Subject: [httpwg/http-extensions] [key] div: removing all WSP characters? (#303) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_58b0406b8559b_54d33fdc0aba1c301125cd"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 Feb 2017 14:17:20 -0000 ----==_mimepart_58b0406b8559b_54d33fdc0aba1c301125cd Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit In the section about div: > 4. Remove all WSP characters from header_value. > 5. If header_value does not match the div ABNF rule, fail parameter processing ({{fail-param}}). So a header value ``` 23 45 ``` will become ``` 2345 ``` which matches `1*DIGIT`; everything is fine? Or is the intention to **trim** the header value? -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/issues/303 ----==_mimepart_58b0406b8559b_54d33fdc0aba1c301125cd Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

In the section about div:

  1. Remove all WSP characters from header_value.
  2. If header_value does not match the div ABNF rule, fail parameter processing ({{fail-param}}).

So a header value

23   45

will become

2345

which matches 1*DIGIT; everything is fine? Or is the intention to trim the header value?

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_58b0406b8559b_54d33fdc0aba1c301125cd-- From nobody Fri Feb 24 06:24:06 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -0.475 X-Spam-Level: X-Spam-Status: No, score=-0.475 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_20=1.546, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=github.com; h=from:reply-to:to:cc:in-reply-to:references:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=9ZhLrw2U69EHCxxAmXhAPpdUitw=; b=cAEQ21ZEZ3rk5FIx OA45oAz9auqbetGDMaa+Si4gIYt6Dgx2SqfPSXUbGJMVtAg+UeIfU/byPviTiG5e 6kXroHQr5cBO3XHUoRnt/MGjoiO+wIee46OMUHeQUzJ4ECPve5e72a0DyzSXNEpo r91APj2/Tt7HDKC7yBltUV9TaXw= Date: Fri, 24 Feb 2017 06:24:02 -0800 To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] [key] div: removing all WSP characters? (#303) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_58b0420267c18_2de33f8617f5d1381559"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 Feb 2017 14:24:05 -0000 ----==_mimepart_58b0420267c18_2de33f8617f5d1381559 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Same in the section about partition. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/issues/303#issuecomment-282303011 ----==_mimepart_58b0420267c18_2de33f8617f5d1381559 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

Same in the section about partition.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_58b0420267c18_2de33f8617f5d1381559-- From nobody Fri Feb 24 06:30:56 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -2.27 X-Spam-Level: X-Spam-Status: No, score=-2.27 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_24=1.618, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H2=-1.887, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=github.com; h=from:reply-to:to:cc:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=tsfkgyulkI7VEgrjrNN4xAUEZZA=; b=rOwh3W0Ke94LuejS HIhB0AFncuVVO5xvTNsgl7wFqP8dpGsWJ+Kub/KyLxIitUTwQ6wNNXPPG10sTeeW FGLOUg41PWHdVdBWMuQHcys2f6dtax5KdrThB8mskS7VTGSZ3D/cErNaV7wpUleV tB+w5OcxxttTA0fsLquAn926IWg= Date: Fri, 24 Feb 2017 06:30:22 -0800 To: httpwg/http-extensions Subject: [httpwg/http-extensions] [key] partition: numbering issue (#304) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_58b0437e9d03e_261c3fdf1c8b3c34736a1"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 Feb 2017 14:30:55 -0000 ----==_mimepart_58b0437e9d03e_261c3fdf1c8b3c34736a1 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit > If header_value is less than segment_value when they are numerically compared, skip to step 7. This should probably refer to step 8 ("Return segment_id.") "For each segment_value in segment_list:" should get the number 7 in the markdown file (6 is already 'Create a list segment_list by splitting parameter_value on ":" characters.'). -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/issues/304 ----==_mimepart_58b0437e9d03e_261c3fdf1c8b3c34736a1 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

If header_value is less than segment_value when they are numerically compared, skip to step 7.

This should probably refer to step 8 ("Return segment_id.")

"For each segment_value in segment_list:" should get the number 7 in the markdown file (6 is already 'Create a list segment_list by splitting parameter_value on ":" characters.').

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_58b0437e9d03e_261c3fdf1c8b3c34736a1-- From nobody Fri Feb 24 09:38:23 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -7.269 X-Spam-Level: X-Spam-Status: No, score=-7.269 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_24=1.618, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H2=-1.887, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Date: Fri, 24 Feb 2017 09:38:19 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1487957899; bh=Us0TMNarHFPJ/dvRdwVFtlpU200zf2n9CyFr5tBGCPM=; h=From:Reply-To:To:Cc:In-Reply-To:References:Subject:List-ID: List-Archive:List-Post:List-Unsubscribe:From; b=RcTGpQLvBOer2y1nzvitCNntW11JFzeYeFcZul7sliy1cWJ7uFpk7hmhpAGXjGE0O ksRmmxsEA1kygQfYqIUMmyUiOKb9vBP13HIRrl3Ln/wzhY0kJA9MihnMcl4tR/p1gG fOFzXd5nkfKUFjGD5y1QStarY3d9i2jFi1U2CzeQ= To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] Requiring Accept-CH (#284) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_58b06f8b29af5_5e73f80bce63c3813373c"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 Feb 2017 17:38:21 -0000 ----==_mimepart_58b06f8b29af5_5e73f80bce63c3813373c Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit PTAL https://github.com/httpwg/http-extensions/pull/305. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/issues/284#issuecomment-282354086 ----==_mimepart_58b06f8b29af5_5e73f80bce63c3813373c Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

PTAL #305.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_58b06f8b29af5_5e73f80bce63c3813373c-- From nobody Fri Feb 24 09:39:15 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -2.02 X-Spam-Level: X-Spam-Status: No, score=-2.02 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_32=0.001, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=github.com; h=from:reply-to:to:cc:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=iQzvshAiG4NygF8rCnnJS1kT9Vs=; b=vdMnFWlQPq/l5/E6 kpgeuIKdb/7Cl8cBdzzRawcpxSMLHn//GtVZ9WcbFJCzhVKGuhuNBmDE4RiJ8Mlg b7B+lndB0WdoOXpSpXHpIi1lh7VBimRJHPs//B4yz+qoPbmT0QUf/XjYFtKkw4Fa 1+u/HQ+CzUeaUU5xm1JTDqGX1FI= Date: Fri, 24 Feb 2017 09:38:00 -0800 To: httpwg/http-extensions Subject: [httpwg/http-extensions] Incorporate feedback on httpbis-client-hints-03 (#305) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_58b06f78c7de8_5c93f80bce63c381409b"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 Feb 2017 17:39:14 -0000 ----==_mimepart_58b06f78c7de8_5c93f80bce63c381409b Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Related discussions: - https://lists.w3.org/Archives/Public/ietf-http-wg/2017JanMar/thread.html#msg143 - https://github.com/httpwg/http-extensions/issues/284 You can view, comment on, or merge this pull request online at: https://github.com/httpwg/http-extensions/pull/305 -- Commit Summary -- * mark NETINFO reference as non-normative * extend guidance for Accept-CH -- File Changes -- M draft-ietf-httpbis-client-hints.md (38) -- Patch Links -- https://github.com/httpwg/http-extensions/pull/305.patch https://github.com/httpwg/http-extensions/pull/305.diff -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/pull/305 ----==_mimepart_58b06f78c7de8_5c93f80bce63c381409b Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

Related discussions:

You can view, comment on, or merge this pull request online at:

  https://github.com/httpwg/http-extensions/pull/305

Commit Summary

  • mark NETINFO reference as non-normative
  • extend guidance for Accept-CH

File Changes

Patch Links:

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_58b06f78c7de8_5c93f80bce63c381409b-- From nobody Fri Feb 24 12:18:39 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -2.484 X-Spam-Level: X-Spam-Status: No, score=-2.484 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_28=1.404, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H2=-1.887, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=github.com; h=from:reply-to:to:cc:in-reply-to:references:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=NWIh/x7z0KqYG2MOlRBa/mzwHHI=; b=Z2cioli5MkzEdirp EgM6ebFP0EK/XvK3uyBgEIY4nMpmK//y00irqehb3aXuEEb2JpFSdtKuJRUx3Ggp R5T45h2uE+4Qg6Q2F5S8knLR+ssBQZHjlfxYpMSPOmBIFYUAV0ReXP+rDHsrTDDQ cyTAfFAYTCCEFcBcJ4izD7ZzXIE= Date: Fri, 24 Feb 2017 12:18:28 -0800 To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] Requiring Accept-CH (#284) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_58b095144a3cf_bdd3fa46a129140179165"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 Feb 2017 20:18:37 -0000 ----==_mimepart_58b095144a3cf_bdd3fa46a129140179165 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit What is the purpose of sending Client Hints to embedded third-parties anyway? How does the user know a response to an embedded subresource contains Accept-CH? There should at least be a user agent setting so third-parties do not receive hints, preferably the default similar to the way third-party cookies are now blocked (somewhat) in Safari. A drive-by Accept-CH will be even more of a privacy risk especially if the user is never informed. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/issues/284#issuecomment-282393991 ----==_mimepart_58b095144a3cf_bdd3fa46a129140179165 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable

What is the purpose of sending Client Hints to embedded third-parties an= yway?
How does the user know a response to an embedded subresource contains Acce= pt-CH? There should at least be a user agent setting so third-parties do no= t receive hints, preferably the default similar to the way third-party cook= ies are now blocked (somewhat) in Safari. A drive-by Accept-CH will be even= more of a privacy risk especially if the user is never informed.

&mda= sh;
You are receiving this because you are subscribed to this thread.<= br />Reply to this email directly, view it on GitHub, or <= a href=3D"https://github.com/notifications/unsubscribe-auth/AORpyAZaM8ad5oS= eOUiAG0lEcGxTQCrtks5rfzsUgaJpZM4LyUDH">mute the thread.3D""

= ----==_mimepart_58b095144a3cf_bdd3fa46a129140179165-- From nobody Fri Feb 24 16:21:41 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -2.02 X-Spam-Level: X-Spam-Status: No, score=-2.02 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_32=0.001, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=github.com; h=from:reply-to:to:cc:in-reply-to:references:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=M3LPR1u0b/3o190poAc1SKU0g/U=; b=vXqVwsylZk9slWqX 0N5au4w6QGP5p7GiNa6RlxhYSMS8F6lwPCfPhsLWtJLFIsR92imUj+sTqEiqfZmy tN94Fj+FzDvGOCzujQXCADvAa3jIMz3RzDJCm4+gxHbHhKXF1HjbZ2BgWAAOnsyb 0eFgfL4RtvB0WmsVktKEzE0J6e8= Date: Fri, 24 Feb 2017 16:21:37 -0800 To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] Requiring Accept-CH (#284) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_58b0ce119b58_7ab43fab160afc34138112"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 25 Feb 2017 00:21:40 -0000 ----==_mimepart_58b0ce119b58_7ab43fab160afc34138112 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit It is common for sites to host resources on a CDN whose origin != document origin -- e.g. I host my images on a third-party image service and I want said CDN to optimize the resources based on advertised CH hints. Note that there is (already) nothing preventing the document from exporting the same data.. most commonly by appending it into the URL of the subresource. Which is to say, and to reiterate once more, CH **does not** expose anything that was not previously available to the document via JavaScript and/or CSS. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/issues/284#issuecomment-282440965 ----==_mimepart_58b0ce119b58_7ab43fab160afc34138112 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable

It is common for sites to host resources on a CDN whose origin !=3D docu= ment origin -- e.g. I host my images on a third-party image service and I w= ant said CDN to optimize the resources based on advertised CH hints. Note t= hat there is (already) nothing preventing the document from exporting the s= ame data.. most commonly by appending it into the URL of the subresource.

Which is to say, and to reiterate once more, CH does not expose anything that was not previously available to the document via Jav= aScript and/or CSS.

&mda= sh;
You are receiving this because you are subscribed to this thread.<= br />Reply to this email directly, view it on GitHub, or <= a href=3D"https://github.com/notifications/unsubscribe-auth/AORpyMSmiYJgaM7= CIxFPlhKOU5656OQOks5rf3QRgaJpZM4LyUDH">mute the thread.3D""

= ----==_mimepart_58b0ce119b58_7ab43fab160afc34138112-- From nobody Sat Feb 25 01:33:30 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -7.482 X-Spam-Level: X-Spam-Status: No, score=-7.482 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_28=1.404, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H2=-1.887, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Date: Sat, 25 Feb 2017 01:33:26 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1488015206; bh=j+8jWeKMwkPtVCHe8MJie6DMvDdqSO8zAHXPrfnfcK8=; h=From:Reply-To:To:Cc:In-Reply-To:References:Subject:List-ID: List-Archive:List-Post:List-Unsubscribe:From; b=naC/hhTCI7/bIIAyI2mjpzXIOZuBp+hG8r9xPyujHashuQwuNvWDuluGwa0N11W2Q vp0dKL23yjGJ5RuljIpQqbld1A+PQGWbJ4mObbt9aTaCD1/wbHyUe6EpxJsBBsgDKm 9WQSc5jE1IGxIsQE8Hi4qKN8+pUmidqsm4KycJqU= To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] Requiring Accept-CH (#284) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_58b14f66d2c44_58063fcdf613113c5764f"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 25 Feb 2017 09:33:29 -0000 ----==_mimepart_58b14f66d2c44_58063fcdf613113c5764f Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit It exposes it to any resource immediately, without needing to return script in html which then has to return information in another request. It makes fingerprinting, already recognised as a privacy risk, much easier, and less detectable. User agents should have default settings that block Client Hints. This could be qualified on a per origin basis by DNT or a new Permission that puts the user in control. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/issues/284#issuecomment-282472678 ----==_mimepart_58b14f66d2c44_58063fcdf613113c5764f Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable

It exposes it to any resource immediately, without needing to return s= cript in html which then has to return information in another request. It= makes fingerprinting, already recognised as a privacy risk, much easier,= and less detectable.
User agents should have default settings that block Client Hints. This co= uld be qualified on a per origin basis by DNT or a new Permission that pu= ts the user in control.

&m= dash;
You are receiving this because you are subscribed to this thre= ad.
Reply to this email directly, view it on GitHub, or mute the thread.

=
= ----==_mimepart_58b14f66d2c44_58063fcdf613113c5764f-- From nobody Sat Feb 25 01:36:36 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -6.84 X-Spam-Level: X-Spam-Status: No, score=-6.84 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_20=1.546, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H2=-1.887, RCVD_IN_SORBS_SPAM=0.5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Date: Sat, 25 Feb 2017 01:36:33 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1488015393; bh=YRyYcZqdL7ysbb5bXr/ev7nITKx5hc12u0kWXMQ4Gwo=; h=From:Reply-To:To:Cc:In-Reply-To:References:Subject:List-ID: List-Archive:List-Post:List-Unsubscribe:From; b=YgUVnC7yLuFGblmFtyX8cRy1/Kp369MJYQplDsxDIEJXgkodT9kiaYMsGteogqeKz zRkj7GUoSompkXeJTdYPtjL6EBrS/IaMaq/AjDVRXCqveEjW96xvTHyUZv1cBaado4 Mk6AIaa4acQ0iK3EGOYL3nuWGrvxMK1/MB32IGyo= To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] Requiring Accept-CH (#284) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_58b15021b853a_2a6a3fcd0eeafc341050ba"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 25 Feb 2017 09:36:35 -0000 ----==_mimepart_58b15021b853a_2a6a3fcd0eeafc341050ba Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit or alternatively invent a mechanism for limiting the entropy -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/issues/284#issuecomment-282472828 ----==_mimepart_58b15021b853a_2a6a3fcd0eeafc341050ba Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

or alternatively invent a mechanism for limiting the entropy

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_58b15021b853a_2a6a3fcd0eeafc341050ba-- From nobody Sat Feb 25 04:33:14 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -0.402 X-Spam-Level: X-Spam-Status: No, score=-0.402 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_24=1.618, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=github.com; h=from:reply-to:to:cc:in-reply-to:references:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=ZKPUUgXPm10ih3E2732kYowHyCk=; b=uBqrsiYFKUEFdqUA ijmtN7ux16HE2TPqAM6AzFT7fvDIF8MXmGzyXz3bP4AvRwrzSVkTABkS7ygX7pav EFq5B1p2bceHaEj579UaFbuP6N+kh2f1hSk2thpCimoONr8IvY+U3tJX5/bcq12Q lRUQFY4AI/wfRrafhhH7QKxM/QI= Date: Sat, 25 Feb 2017 04:33:09 -0800 To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] Requiring Accept-CH (#284) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_58b1798556183_3c903f85d3fcd13426603f"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 25 Feb 2017 12:33:12 -0000 ----==_mimepart_58b1798556183_3c903f85d3fcd13426603f Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit probably we can have an option for whitelisting / blacklisting the domains client hints should be sent to as a meta tag as well (CSP-style) -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/issues/284#issuecomment-282481180 ----==_mimepart_58b1798556183_3c903f85d3fcd13426603f Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

probably we can have an option for whitelisting / blacklisting the domains client hints should be sent to as a meta tag as well (CSP-style)

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_58b1798556183_3c903f85d3fcd13426603f-- From nobody Sat Feb 25 09:03:16 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -3.886 X-Spam-Level: X-Spam-Status: No, score=-3.886 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_32=0.001, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H2=-1.887, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=github.com; h=from:reply-to:to:cc:in-reply-to:references:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=uj0hOR3BlS7b8Lqm0KW28494TVk=; b=M2fdILyzqKux3EhU g8XTWzJwwYcfrKDPYpyvvTUogEJdSC/bsM956VE1wHJI5Kaj7IxLR7HTy7FlsSlY 8xsT79FWVM/Q7F1yUsNRji9iG5iDiXd7uNkbniQUi83992GUseGjy7fBrz3HFIGZ 7lFSZgBDr1hNgBFKJisZOovNk8w= Date: Sat, 25 Feb 2017 09:03:10 -0800 To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] Requiring Accept-CH (#284) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_58b1b8ced36a2_56673fbd35021138813ca"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 25 Feb 2017 17:03:15 -0000 ----==_mimepart_58b1b8ced36a2_56673fbd35021138813ca Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable > User agents should have default settings that block Client Hints. This co= uld be qualified on a per origin basis by DNT or a new Permission that puts= the user in control. As I said earlier=E2=80=94see https://github.com/httpwg/http-extensions/iss= ues/284#issuecomment-279151499=E2=80=94our guidance in the spec allows for = this and we do recommend that they use Accept-CH as an opt-in. I'm not agai= nst DNT or additional permissions, but we're not in a position to make thes= e policy decisions here; those decisions need to be made by the implementer= s. I don't think we're going to get much further in this discussion in this= forum. --=20 You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/issues/284#issuecomment-282496922= ----==_mimepart_58b1b8ced36a2_56673fbd35021138813ca Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable

User agents should have default settings that block Client Hints. This c= ould be qualified on a per origin basis by DNT or a new Permission that put= s the user in control.

As I said earlier=E2=80=94see https://github.co= m/httpwg/http-extensions/issues/284#issuecomment-279151499=E2=80=94our = guidance in the spec allows for this and we do recommend that they use Acce= pt-CH as an opt-in. I'm not against DNT or additional permissions, but we'r= e not in a position to make these policy decisions here; those decisions ne= ed to be made by the implementers. I don't think we're going to get much fu= rther in this discussion in this forum.

&mda= sh;
You are receiving this because you are subscribed to this thread.<= br />Reply to this email directly, view it on GitHub, or <= a href=3D"https://github.com/notifications/unsubscribe-auth/AORpyJ-HVq-8CpM= pAnpufBYBtZi2JJC1ks5rgF7OgaJpZM4LyUDH">mute the thread.3D""

= ----==_mimepart_58b1b8ced36a2_56673fbd35021138813ca-- From nobody Sun Feb 26 04:44:43 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -2.342 X-Spam-Level: X-Spam-Status: No, score=-2.342 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_20=1.546, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H2=-1.887, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=github.com; h=from:reply-to:to:cc:in-reply-to:references:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=Dk4JcEbanGMXgfvyxLOKqhuwk+Y=; b=H5lK7hrW0lgZn/d7 ND0FJdNhbdjW0WEY8hQfs07d1P7ialKxwxauNcKCZ4Yh7GPNmCJfW3mke/j+cl6X 2FApfizdbWdsjm3gSGbqfteDkeYm6Zwg3LIL63OQ7QY8ZwxoUxYZsVGq6jWYlViy wa/tczWj4T+nE6QfF/1bLbPHsaI= Date: Sun, 26 Feb 2017 04:44:39 -0800 To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] Incorporate feedback on httpbis-client-hints-03 (#305) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_58b2cdb71d21e_4b133f9c87e8d13c166767"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 26 Feb 2017 12:44:41 -0000 ----==_mimepart_58b2cdb71d21e_4b133f9c87e8d13c166767 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit yoavweiss approved this pull request. LGTM -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/pull/305#pullrequestreview-23880870 ----==_mimepart_58b2cdb71d21e_4b133f9c87e8d13c166767 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

@yoavweiss approved this pull request.

LGTM

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_58b2cdb71d21e_4b133f9c87e8d13c166767-- From nobody Sun Feb 26 21:04:50 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H2=-0.001, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=github.com; h=from:reply-to:to:cc:in-reply-to:references:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=Lx1VlLbKWLuTWfjTeB4RtkgJ2nw=; b=IfL5LBWYDXjr2pfQ fv7+LxPBk8RyhViY07TOwr+FniGKMxBRPvVBF1MBAqThcKVqGOcZL43W5O+a0eBN B9cnPNh6WzCc/CNLXKA4qgysF37XulN/z8RlF/yKrR/oxvyh2xNL7U08YU6pdh8b +BBMl/nqf6e7UDUytcnC72Gk0gw= Date: Sun, 26 Feb 2017 21:04:45 -0800 To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] Incorporate feedback on httpbis-client-hints-03 (#305) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_58b3b36d95e19_8a73fbc38069c3814434"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Feb 2017 05:04:48 -0000 ----==_mimepart_58b3b36d95e19_8a73fbc38069c3814434 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit mnot requested changes on this pull request. > @@ -130,7 +130,7 @@ Further, depending on the used hint, the server can emit additional response hea ### Advertising Support for Client Hints {#accept-ch} -Servers can advertise support for Client Hints using the Accept-CH header field or an equivalent HTML meta element with http-equiv attribute ({{W3C.REC-html5-20141028}}). +Servers should advertise support for Client Hints using the Accept-CH header field or an equivalent HTML meta element with http-equiv attribute ({{W3C.REC-html5-20141028}}). "should" is a special word in the IETF -- do you mean SHOULD (i.e., an RFC2119 requirement)? If not, "can" is better. SHOULD is a bit problematic here, because typically when you use it, you should define the circumstances when the requirement can be violated. > @@ -116,7 +116,7 @@ A Client Hint request header field is a HTTP header field that is used by HTTP c ## Sending Client Hints -Clients control which Client Hint headers and their respective header fields are communicated, based on their default settings, user configuration and/or preferences. The user can be given the choice to enable, disable, or override specific hints. +Clients control which Client Hint headers and their respective header fields are communicated, based on their default settings, user configuration and/or preferences. Implementers might provide user choice mechanisms so that users may balance privacy concerns with bandwidth limitations. Implementations specific to certain use cases or threat models might avoid transmitting these headers altogether, or limit them to secure contexts or authenticated sessions. Implementers should be aware that explaining the privacy implications of passive fingerprinting or network information disclosure may be challenging. "Clients control which Client Hint headers and their respective header fields are communicated" -- this wording is odd. Suggest: "Clients control which Client Hints are sent in requests, based..." > @@ -233,7 +233,7 @@ If Viewport-Width occurs in a message more than once, the last value overrides a # The Downlink Client Hint {#downlink} -The "Downlink" request header field is a number that indicates the client's maximum downlink speed in megabits per second (Mbps), as defined by the "downlinkMax" attribute in the W3C Network Information API ({{NETINFO}}). +The "Downlink" request header field is a number that indicates the client's maximum downlink speed in megabits per second (Mbps). For example, as defined by the "downlinkMax" attribute in the W3C Network Information API ({{NETINFO}}). I don't think defining the semantics in a "For example" is going to fly here. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/pull/305#pullrequestreview-23913445 ----==_mimepart_58b3b36d95e19_8a73fbc38069c3814434 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

@mnot requested changes on this pull request.

In draft-ietf-httpbis-client-hints.md:

> @@ -130,7 +130,7 @@ Further, depending on the used hint, the server can emit additional response hea
 
 ### Advertising Support for Client Hints {#accept-ch}
 
-Servers can advertise support for Client Hints using the Accept-CH header field or an equivalent HTML meta element with http-equiv attribute ({{W3C.REC-html5-20141028}}).
+Servers should advertise support for Client Hints using the Accept-CH header field or an equivalent HTML meta element with http-equiv attribute ({{W3C.REC-html5-20141028}}).

"should" is a special word in the IETF -- do you mean SHOULD (i.e., an RFC2119 requirement)? If not, "can" is better.

SHOULD is a bit problematic here, because typically when you use it, you should define the circumstances when the requirement can be violated.

In draft-ietf-httpbis-client-hints.md:

> @@ -116,7 +116,7 @@ A Client Hint request header field is a HTTP header field that is used by HTTP c
 
 ## Sending Client Hints
 
-Clients control which Client Hint headers and their respective header fields are communicated, based on their default settings, user configuration and/or preferences. The user can be given the choice to enable, disable, or override specific hints.
+Clients control which Client Hint headers and their respective header fields are communicated, based on their default settings, user configuration and/or preferences. Implementers might provide user choice mechanisms so that users may balance privacy concerns with bandwidth limitations. Implementations specific to certain use cases or threat models might avoid transmitting these headers altogether, or limit them to secure contexts or authenticated sessions. Implementers should be aware that explaining the privacy implications of passive fingerprinting or network information disclosure may be challenging.

"Clients control which Client Hint headers and their respective header fields are communicated" -- this wording is odd. Suggest:

"Clients control which Client Hints are sent in requests, based..."

In draft-ietf-httpbis-client-hints.md:

> @@ -233,7 +233,7 @@ If Viewport-Width occurs in a message more than once, the last value overrides a
 
 # The Downlink Client Hint {#downlink}
 
-The "Downlink" request header field is a number that indicates the client's maximum downlink speed in megabits per second (Mbps), as defined by the "downlinkMax" attribute in the W3C Network Information API ({{NETINFO}}).
+The "Downlink" request header field is a number that indicates the client's maximum downlink speed in megabits per second (Mbps). For example, as defined by the "downlinkMax" attribute in the W3C Network Information API ({{NETINFO}}).

I don't think defining the semantics in a "For example" is going to fly here.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_58b3b36d95e19_8a73fbc38069c3814434-- From nobody Sun Feb 26 21:13:28 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -0.383 X-Spam-Level: X-Spam-Status: No, score=-0.383 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_24=1.618, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H2=-0.001, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=github.com; h=from:reply-to:to:cc:in-reply-to:references:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=RCmo+QOCwbUf9YoHC9pmnnqLXFg=; b=kw+sHbBG+CNBLaTJ ek8kd0XVEk692Iu2NP8OE9OyBOLyS4gv+dWegd0/pu9fR4w4L4B30dDN3ps6FLm6 NNqYFVntX7/ASuH8/mD8snQEw0wOfbDKMQ7ZQFVflQy6HWMu+vum1H5tb3OLNI0V WA1gEyMVvtSyBdJPRkrw9QWY6Ns= Date: Sun, 26 Feb 2017 21:13:24 -0800 To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] Requiring Accept-CH (#284) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_58b3b574b461e_19033f99ed9b31301103ba"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Feb 2017 05:13:27 -0000 ----==_mimepart_58b3b574b461e_19033f99ed9b31301103ba Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit And to be clear, this spec is for the protocol aspects of CH. We need to note the privacy and security considerations, but how it's actually used is application-specific, and the place that's being done for Web browsers is the Fetch spec. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/issues/284#issuecomment-282629843 ----==_mimepart_58b3b574b461e_19033f99ed9b31301103ba Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable

And to be clear, this spec is for the protocol aspects of CH. We need to= note the privacy and security considerations, but how it's actually used i= s application-specific, and the place that's being done for Web browsers is= the Fetch spec.

&mda= sh;
You are receiving this because you are subscribed to this thread.<= br />Reply to this email directly, view it on GitHub, or <= a href=3D"https://github.com/notifications/unsubscribe-auth/AORpyOGDIIgCwP8= Fytvbp7ui34PEOksjks5rglt0gaJpZM4LyUDH">mute the thread.3D""

= ----==_mimepart_58b3b574b461e_19033f99ed9b31301103ba-- From nobody Sun Feb 26 21:41:26 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -0.402 X-Spam-Level: X-Spam-Status: No, score=-0.402 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_24=1.618, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=github.com; h=from:reply-to:to:cc:in-reply-to:references:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=fuuD0YwDmJ3Yh36i7QT7b74tpdg=; b=fFxfTTvNv9qVdBAv u8sVl1RxeG+WrTeeLv/QfjQYWK8t487iHW/Kr9DhRVG8TiQGjSQg3loH80DvSaJb CrEC6YZF3b4bEJZZhjDP1xRGdy8uCT92c8LaCC6PsuF+S49KwrCi5RR4V33p98E9 mIHmDEBjLj7AeQs8zq4inJOuiM4= Date: Sun, 26 Feb 2017 21:41:22 -0800 To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] Incorporate feedback on httpbis-client-hints-03 (#305) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_58b3bc02f2a28_4d373fa4dda85c34791a4"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Push Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Feb 2017 05:41:25 -0000 ----==_mimepart_58b3bc02f2a28_4d373fa4dda85c34791a4 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit @igrigorik pushed 1 commit. 1e0c2d2 cleanup based on feedback -- You are receiving this because you are subscribed to this thread. View it on GitHub: https://github.com/httpwg/http-extensions/pull/305/files/a2bb64184fce9986ddebf37db1a1a5a8e497a431..1e0c2d272dd5c4829aa6502a8a0e22411b2f0eec ----==_mimepart_58b3bc02f2a28_4d373fa4dda85c34791a4 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

@igrigorik pushed 1 commit.

  • 1e0c2d2 cleanup based on feedback

—
You are receiving this because you are subscribed to this thread.
View it on GitHub or mute the thread.

----==_mimepart_58b3bc02f2a28_4d373fa4dda85c34791a4-- From nobody Sun Feb 26 21:41:49 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -0.474 X-Spam-Level: X-Spam-Status: No, score=-0.474 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_20=1.546, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=github.com; h=from:reply-to:to:cc:in-reply-to:references:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=cYZeE5oiX/sWMxWghx9AtlPIxbo=; b=Pt3KibIRAKqmZ8oV /nqCybZDPvFZbA//gw3zh3UU63XDjDTDHthluul+r5aep3pbMEo3jnx2FkRHyt0P 48XfTRfFIqTXwGjN7ydR80Xl/2zy1gQYc76uWm7YOTu+lAH05Ij7CI0kJm2UUCJG LvRuDr3En4T8XR6aUxRPDcLXHkU= Date: Sun, 26 Feb 2017 21:41:40 -0800 To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] Incorporate feedback on httpbis-client-hints-03 (#305) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_58b3bc1446b68_4f9e3fa895913c3c58690"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Feb 2017 05:41:48 -0000 ----==_mimepart_58b3bc1446b68_4f9e3fa895913c3c58690 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit @mnot thanks for the review, updated.. ptal. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/pull/305#issuecomment-282632973 ----==_mimepart_58b3bc1446b68_4f9e3fa895913c3c58690 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

@mnot thanks for the review, updated.. ptal.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_58b3bc1446b68_4f9e3fa895913c3c58690-- From nobody Sun Feb 26 21:45:36 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -5.454 X-Spam-Level: X-Spam-Status: No, score=-5.454 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_20=1.546, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Date: Sun, 26 Feb 2017 21:45:33 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1488174333; bh=AFQocbgf+ZcH4r2dfCNzAKLExLcbkR7VFxov7ltutHc=; h=From:Reply-To:To:Cc:In-Reply-To:References:Subject:List-ID: List-Archive:List-Post:List-Unsubscribe:From; b=m0CP3askZ6oDSNJyxHE7Jx2RaqpAapvNrcIe8m0ceREV2gPWBrKfG61J+OcU6yf7o UnA6hzrl7fkmTOW5sFvpYphCfKiCL53AEYOjnpC7k6JSxIV7OG6dmU0ONpVS8ln/6S EJxi5JIrdizO8TQmJCEbY4E+Dpjwjl5tVIsxqIqM= To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] Incorporate feedback on httpbis-client-hints-03 (#305) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_58b3bcfd5d1d2_4ce43fa4dda85c341141a0"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Feb 2017 05:45:35 -0000 ----==_mimepart_58b3bcfd5d1d2_4ce43fa4dda85c341141a0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit mnot approved this pull request. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/pull/305#pullrequestreview-23915976 ----==_mimepart_58b3bcfd5d1d2_4ce43fa4dda85c341141a0 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

@mnot approved this pull request.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_58b3bcfd5d1d2_4ce43fa4dda85c341141a0-- From nobody Sun Feb 26 21:49:45 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -0.455 X-Spam-Level: X-Spam-Status: No, score=-0.455 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_20=1.546, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H2=-0.001, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=github.com; h=from:reply-to:to:cc:in-reply-to:references:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=TJjq3istUvmr4j0dv9QgoGbroJQ=; b=ro3+G1UILsDlubAT UxGhTOAhu12Yk4YPf/75A1Ibwn8BePGAuC+T8T+rfRdKjfKDqrtmMFI4LNdUgS0r SrF5D7/aPbX1AASu0YJos+yjyufrz36i219OY+UGdJSW+bex1PuBwPRW9V4YDWtC 76+JnjbIOt25C1/fiI5/17cR6n0= Date: Sun, 26 Feb 2017 21:48:39 -0800 To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] Incorporate feedback on httpbis-client-hints-03 (#305) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_58b3bdb7b1a1f_65813fc3b018b13c1659b5"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Feb 2017 05:49:44 -0000 ----==_mimepart_58b3bdb7b1a1f_65813fc3b018b13c1659b5 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Thanks! -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/pull/305#issuecomment-282633845 ----==_mimepart_58b3bdb7b1a1f_65813fc3b018b13c1659b5 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

Thanks!

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_58b3bdb7b1a1f_65813fc3b018b13c1659b5-- From nobody Sun Feb 26 21:50:04 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -0.383 X-Spam-Level: X-Spam-Status: No, score=-0.383 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_24=1.618, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H2=-0.001, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=github.com; h=from:reply-to:to:cc:in-reply-to:references:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=Q5Xngvu5rBJWI/B+fo0QI8M2I+A=; b=q3Y0CoGVFab2EhKG bCP2Hx7dMla8oozaebAVovmfCYR/s/4xQfSlB79xRLQs+xgdkMjSn7gvSiiGx4fX fIo4eQIWHFkS1vaFGhyeUQGDk06VgOR9s5V4+jHvLtAJhgROoFznIUOvic224FKo 3KaO2q57kKSQ9OqGoEjyQzQiYaE= Date: Sun, 26 Feb 2017 21:48:59 -0800 To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] Requiring Accept-CH (#284) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_58b3bdcb2b64b_6a683fe788e9313024304"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Feb 2017 05:50:03 -0000 ----==_mimepart_58b3bdcb2b64b_6a683fe788e9313024304 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Closed #284. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/issues/284#event-977810451 ----==_mimepart_58b3bdcb2b64b_6a683fe788e9313024304 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

Closed #284.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_58b3bdcb2b64b_6a683fe788e9313024304-- From nobody Sun Feb 26 21:50:10 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -0.402 X-Spam-Level: X-Spam-Status: No, score=-0.402 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_24=1.618, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=github.com; h=from:reply-to:to:cc:in-reply-to:references:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=VUTgjt0TjYnKOUo4YOP3Aep15pI=; b=EWjLOUOwl0CMWjWq Ux0MgIS/5UYX5+daARlmkeZ9LdgWvj8AyMXmPlk7g5oJtcSdu0zVe/ENmasKNlZz oxDwL/y4XzUQatEB7X5y2s/TsVRVTbHL5f03H8GdNKUXGc8ieycB2by+l0kbVict xawdTFre8TTPOt2lwcHJi/BBudg= Date: Sun, 26 Feb 2017 21:48:58 -0800 To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] Requiring Accept-CH (#284) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_58b3bdcacda49_4ce73fa4dda85c3419816"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Feb 2017 05:50:04 -0000 ----==_mimepart_58b3bdcacda49_4ce73fa4dda85c3419816 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Resolved via https://github.com/httpwg/http-extensions/pull/305. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/issues/284#issuecomment-282633883 ----==_mimepart_58b3bdcacda49_4ce73fa4dda85c3419816 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

Resolved via #305.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_58b3bdcacda49_4ce73fa4dda85c3419816-- From nobody Sun Feb 26 21:58:28 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -5.381 X-Spam-Level: X-Spam-Status: No, score=-5.381 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_24=1.618, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Date: Sun, 26 Feb 2017 21:48:32 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1488174512; bh=UulORPzrbpKsMJpoarLHUeTXJJeJQTdrCrW50rMvdss=; h=From:Reply-To:To:Cc:In-Reply-To:References:Subject:List-ID: List-Archive:List-Post:List-Unsubscribe:From; b=sz75zzyf3+YAUOQROAlyqnhfRfCo1KxywyNA4daJ2trBynEnD1/ObDxX9D2gTkL8N uQzU3IbQIHbBsCU1r+ThJ8XCCtJW+XGIC/oC0QoDM2RYAn6QoxVeSX0HbzL1XGV/fi mC+qn0hsHhAq19NZEZJ05ss0x3pT/+GrYDWR6CpQ= To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] Incorporate feedback on httpbis-client-hints-03 (#305) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_58b3bdb04c89e_7d3e3ffcc511b14076450"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Feb 2017 05:58:27 -0000 ----==_mimepart_58b3bdb04c89e_7d3e3ffcc511b14076450 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Merged #305. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/pull/305#event-977810149 ----==_mimepart_58b3bdb04c89e_7d3e3ffcc511b14076450 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

Merged #305.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_58b3bdb04c89e_7d3e3ffcc511b14076450-- From nobody Sun Feb 26 23:17:11 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -6.999 X-Spam-Level: X-Spam-Status: No, score=-6.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_32=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Date: Sun, 26 Feb 2017 23:17:06 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1488179826; bh=aRbFHNBM+KNXpDfbJRyaBNF0HVqtIn8iTijUlp0tQL0=; h=From:Reply-To:To:Cc:Subject:List-ID:List-Archive:List-Post: List-Unsubscribe:From; b=YC4QsGgUldpsyAJAHAmQfv1hEAEhI4x3Iv4wqxAt8PnlVU1IwSJuRR+Wp9qtnWtZG o+PmXsS9YxQcfzcDayTh9r1MSN6kH86DBdWVfMFnsfII+ws7xGW1otyowhWfmHT/Jb guu1uYCvOoBXLZcX8T28SQ/Nyu0FouT86QP1Jrlw= To: httpwg/http-extensions Subject: [httpwg/http-extensions] Allow servers to specify max-age in the client hints header (#306) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_58b3d2728b686_23133fa895913c3c89114"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Feb 2017 07:17:09 -0000 ----==_mimepart_58b3d2728b686_23133fa895913c3c89114 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit The [Accept-CH](http://httpwg.org/http-extensions/client-hints.html) header is currently included by origin servers in HTTP responses if they are interested in receiving client hints from the browser (e.g., DPR). The spec currently does not require browsers to persist the opt-in across browser restarts. This means that if the origins are interested in receiving hints on all requests, then they need to include the Accept-CH header on all responses. This has two disadvantages: (i) Browsers currently fail to include the hints on the first request after the browser restart; and, (ii) It may not be possible for the origin servers to include the Accept-CH header on all responses due to responses being served out of different endpoints (CDNs etc.). To fix this: The Accept-CH header should also support a [max-age](http://wicg.github.io/reporting/#max-age-member) header value which indicates for how long should the browser remember this opt-in (including across browser restarts). A value of max-age set to 0 should cause the browser to stop sending client-hints to the origin. As an example, `Accept-CH: feature1, feature2, max-age=86400` would imply that the browser should include hints `feature1` and `feature2` for next 86400 seconds for that origin. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/issues/306 ----==_mimepart_58b3d2728b686_23133fa895913c3c89114 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

The Accept-CH header is currently included by origin servers in HTTP responses if they are interested in receiving client hints from the browser (e.g., DPR). The spec currently does not require browsers to persist the opt-in across browser restarts. This means that if the origins are interested in receiving hints on all requests, then they need to include the Accept-CH header on all responses. This has two disadvantages: (i) Browsers currently fail to include the hints on the first request after the browser restart; and, (ii) It may not be possible for the origin servers to include the Accept-CH header on all responses due to responses being served out of different endpoints (CDNs etc.).

To fix this: The Accept-CH header should also support a max-age header value which indicates for how long should the browser remember this opt-in (including across browser restarts). A value of max-age set to 0 should cause the browser to stop sending client-hints to the origin. As an example,

Accept-CH: feature1, feature2, max-age=86400

would imply that the browser should include hints feature1 and feature2 for next 86400 seconds for that origin.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_58b3d2728b686_23133fa895913c3c89114-- From nobody Mon Feb 27 09:25:54 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -5.596 X-Spam-Level: X-Spam-Status: No, score=-5.596 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_28=1.404, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Date: Mon, 27 Feb 2017 09:25:51 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1488216351; bh=sC8eDkgXD6/EbkI/RCr6G6Hcpz4wz6s906kIbui6zOg=; h=From:Reply-To:To:Cc:In-Reply-To:References:Subject:List-ID: List-Archive:List-Post:List-Unsubscribe:From; b=miDXkUHvDB9aHqvtalYAoVNLYaT1huanp7prxkeDsvTpaMLc4nke2BOJnH5jag6sl 3yb6uP6xznBcivujVSZ4LmMCK8To6Ii8+Esuep3HvPaIyH8CCVIfkp4jdikMmu6uBG DOv5qlI1EuCUUynT3x+dAyGCMgazaY/rIi3H3DXs= To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] Allow servers to specify max-age in the client hints header (#306) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_58b4611f4ac72_10193fc7a8853c3489750"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Feb 2017 17:25:54 -0000 ----==_mimepart_58b4611f4ac72_10193fc7a8853c3489750 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit It crossed my mind also that the response determines a future request, so how long in the future? Why not create a well-known named cookie, similar to the cookie prefix idea in RFC6265bis, then use that to convey Accept-CH. Then you get the potential fingerprinting showing up in the cook,ie store where the user (or privacy extensions) can see it. You also get the expiry functionality for free. And the SameSite attribute to help with privacy. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/issues/306#issuecomment-282788867 ----==_mimepart_58b4611f4ac72_10193fc7a8853c3489750 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable

It crossed my mind also that the response determines a future request,= so how long in the future?

Why not create a well-known named cookie, similar to the cookie prefix= idea in RFC6265bis, then use that to convey Accept-CH. Then you get the = potential fingerprinting showing up in the cook,ie store where the user (= or privacy extensions) can see it. You also get the expiry functionality = for free.

And the SameSite attribute to help with privacy.

&m= dash;
You are receiving this because you are subscribed to this thre= ad.
Reply to this email directly, view it on GitHub, or mute the thread.

=
= ----==_mimepart_58b4611f4ac72_10193fc7a8853c3489750-- From nobody Mon Feb 27 10:12:41 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -0.383 X-Spam-Level: X-Spam-Status: No, score=-0.383 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_24=1.618, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H2=-0.001, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=github.com; h=from:reply-to:to:cc:in-reply-to:references:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=Ivp0bwHFaVbH2LDtbu0otJcMW9o=; b=SqlFSzTuOuhIKio2 kZ6Llm8QEYzxJvJNP19yHtmQHI4GO64KSNqw3dOj6bguhhEDUPzGcsALpuCIOWLl YmPlyVyYqO3YLC2+9bcCFQkb7vfh7lT5RXEi79W5pwUf1i2L2vadBbpbyWX4EV1d OENbwpfQ3vSas8CQHww24Je+q80= Date: Mon, 27 Feb 2017 10:12:15 -0800 To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] Allow servers to specify max-age in the client hints header (#306) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_58b46bff40b94_59a73f9d3fd61c3c78329"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Feb 2017 18:12:39 -0000 ----==_mimepart_58b46bff40b94_59a73f9d3fd61c3c78329 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit @michael-oneill I am not sure if cookies are the best place to store this information given that cookies are used by servers for state management, and this does not seem to fit that use case. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/issues/306#issuecomment-282801985 ----==_mimepart_58b46bff40b94_59a73f9d3fd61c3c78329 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

@michael-oneill I am not sure if cookies are the best place to store this information given that cookies are used by servers for state management, and this does not seem to fit that use case.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_58b46bff40b94_59a73f9d3fd61c3c78329-- From nobody Tue Feb 28 01:51:40 2017 Delivered-To: http-issues@ietfa.amsl.com X-Spam-Flag: NO X-Spam-Score: -0.598 X-Spam-Level: X-Spam-Status: No, score=-0.598 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_28=1.404, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H2=-0.001, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=github.com; h=from:reply-to:to:cc:in-reply-to:references:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=GtjrQlvKLiUWTkuV8o7bA3eQDew=; b=QXgweVJKkdjtlnoh EYj+egzxXL2Pn2ycCf5/q8IGu3+LwopaUYvKPhmxBFpkBVjKAcfn9QEH8KeRS/Wa rFXJGZYiJhrfKC+S9auLIFINqK/Ehoc6FiU7UPQ22BlnNSnfzb91Ho8fmgtITuS/ iXTt81fz1bkXOsodjTVYAmuQkfQ= Date: Tue, 28 Feb 2017 01:51:36 -0800 To: httpwg/http-extensions In-Reply-To: References: Subject: Re: [httpwg/http-extensions] Allow servers to specify max-age in the client hints header (#306) Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_58b54828ee8ac_74ad3fb9c506fc3490754"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list Archived-At: Cc: Subscribed Message-ID: From: HTTP issue updates X-BeenThere: http-issues@ietf.org X-Mailman-Version: 2.1.17 Reply-To: http-issues@ietf.org List-Id: HTTP issue updates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Feb 2017 09:51:39 -0000 ----==_mimepart_58b54828ee8ac_74ad3fb9c506fc3490754 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Accept-CH makes the UA retain the state on what Client Hints are to be sent in future requests. The problem with Client Hints is that they can (will) be used to identify users by fingerprinting their UAs. Users know to some extent that cookies are used to identify them, so why not hold this identifying styate their also. It increases transparency,, enables user control and does not re-invent the wheel. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/httpwg/http-extensions/issues/306#issuecomment-282993375 ----==_mimepart_58b54828ee8ac_74ad3fb9c506fc3490754 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable

Accept-CH makes the UA retain the state on what Client Hints are to be s= ent in future requests. The problem with Client Hints is that they can (wil= l) be used to identify users by fingerprinting their UAs.

Users know to some extent that cookies are used to identify them, so why= not hold this identifying styate their also.

It increases transparency,, enables user control and does not re-invent = the wheel.

&mda= sh;
You are receiving this because you are subscribed to this thread.<= br />Reply to this email directly, view it on GitHub, or <= a href=3D"https://github.com/notifications/unsubscribe-auth/AORpyIWoQH-Hm-V= 641fCDAy6n9ARfbDzks5rg-4ogaJpZM4MMxOI">mute the thread.3D""

= ----==_mimepart_58b54828ee8ac_74ad3fb9c506fc3490754--