Subject: [OAUTH-WG] token sizes and other, as discussed in Section 3.2

From: Eliot Lear <[email-masked]>
Date: Wed, 14 Apr 2010 08:05:01 +0200

It would seem to me that the purpose of this specification should be 
to reduce the amount of work implementers have to do, in order to 
actually have functioning interoperable systems.  Otherwise, why even 
bother with any of this, and why not simply have each server hand out an 
SDK?  It seems to me that you want THIS document to specify as MUCH as 
possible, so that server documentation can specify as LITTLE as 
necessary to get things working.  Otherwise library implementations 
become complex and implementations become error prone, which in this 
case means prone to security problems.

This to me means that Section 3.2 needs rewording.

Eliot

---

From: David Recordon <[email-masked]>
Date: Tue, 13 Apr 2010 23:13:12 -0700

Hey Elliot,
Have some text to propose?

Thanks,
--David

On Tue, Apr 13, 2010 at 11:05 PM, Eliot Lear <[email-masked]> wrote:
> It would seem to me that the purpose of this specification should be to
> reduce the amount of work implementers have to do, in order to actually have
> functioning interoperable systems.  Otherwise, why even bother with any of
> this, and why not simply have each server hand out an SDK?  It seems to me
> that you want THIS document to specify as MUCH as possible, so that server
> documentation can specify as LITTLE as necessary to get things working.
> Otherwise library implementations become complex and implementations become
> error prone, which in this case means prone to security problems.
>
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth
>
>

---

From: Eliot Lear <[email-masked]>
Date: Wed, 14 Apr 2010 11:50:16 +0200

On 4/14/10 8:13 AM, David Recordon wrote:
> Hey Eliot,

Not yet.  I'd suggest talking about the problem a bit more first.  
Would, for instance, specifying a basic TLV encoding prove at all 
useful?  Here's one throw one more thing to throw into the mix.  Were 
this a SERVER, it could return a 414 and at least you'd have some vague 
notion as to a length problem.  How does a client report an error to a 
server?

Eliot