Ben Campbell's Yes on draft-ietf-httpbis-expect-ct-07: (with COMMENT)

[Ben Campbell]

Ben Campbell has entered the following ballot position for
draft-ietf-httpbis-expect-ct-07: Yes

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)


Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.


The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-httpbis-expect-ct/



----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Thanks for this work. I'm balloting "Yes", but I have a few minor comments.

Substantive:

§2.1, step 6: Is there no room for local policy here?

§2.1.3: The guidance for max-age in the security considerations section
suggests 30 days is a good value. But the directive is specified in seconds.
Does that make sense? Would a 1 second max-age ever be reasonable? Or even 30
days + 1 second?

Editorial:

- General: This uses a non-standard section order towards the end.
Conventionally the last 2 sections should be security considerations and IANA
considerations (although the order between those two varies.)

§2.2.2: The second sentence is about UA behavior. It seems like that belongs
somewhere under §2.3.

§2.3: "SHALL be canonicalized"
By the UA? (The use of passive voice here obscures the actor.)

[Mark Nottingham]

Hi Ben,

Just one comment -

Post by Ben Campbell
Ben Campbell has entered the following ballot position for
draft-ietf-httpbis-expect-ct-07: Yes
When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)
Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.
https://datatracker.ietf.org/doc/draft-ietf-httpbis-expect-ct/
----------------------------------------------------------------------
----------------------------------------------------------------------
Thanks for this work. I'm balloting "Yes", but I have a few minor comments.
§2.1, step 6: Is there no room for local policy here?
§2.1.3: The guidance for max-age in the security considerations section
suggests 30 days is a good value. But the directive is specified in seconds.
Does that make sense? Would a 1 second max-age ever be reasonable? Or even 30
days + 1 second?

Pretty much everything in HTTP is done at second granularity; deviating from that would be odd IMO.

Cheers,

Post by Ben Campbell
- General: This uses a non-standard section order towards the end.
Conventionally the last 2 sections should be security considerations and IANA
considerations (although the order between those two varies.)
§2.2.2: The second sentence is about UA behavior. It seems like that belongs
somewhere under §2.3.
§2.3: "SHALL be canonicalized"
By the UA? (The use of passive voice here obscures the actor.)

--
Mark Nottingham https://www.mnot.net/

[Mark Nottingham]

Hi Mark,
Just one comment-question :-)

Post by Mark Nottingham

Post by Ben Campbell
§2.1.3: The guidance for max-age in the security considerations section
suggests 30 days is a good value. But the directive is specified in seconds.
Does that make sense? Would a 1 second max-age ever be reasonable? Or even 30
days + 1 second?

Pretty much everything in HTTP is done at second granularity; deviating from that would be odd IMO.

I certainly don’t have all the HTTP uses of time intervals loaded in my head--are time intervals on the order of “1 month” commonly used elsewhere?

In that sort of syntax, no. The desired semantic is often something like that, but the syntax is almost invariably integer-number-of-seconds.

Cheers,



--
Mark Nottingham https://www.mnot.net/

[Ben Campbell]

Post by Mark Nottingham

Hi Mark,
Just one comment-question :-)

Post by Mark Nottingham

§2.1.3: The guidance for max-age in the security considerations section
suggests 30 days is a good value. But the directive is specified in seconds.
Does that make sense? Would a 1 second max-age ever be reasonable? Or even 30
days + 1 second?

Pretty much everything in HTTP is done at second granularity; deviating from that would be odd IMO.

I certainly don’t have all the HTTP uses of time intervals loaded in my head--are time intervals on the order of “1 month” commonly used elsewhere?

In that sort of syntax, no. The desired semantic is often something like that, but the syntax is almost invariably integer-number-of-seconds.

I’m not entirely sure I follow, but I think you are saying that it is common to have month-long time intervals that are specified in seconds. Is that correct?

In any case, it’s a non-blocking comment. If there’s good reason (e.g. “the parsers all already understand seconds”) to do this in seconds I’m okay with it.

Post by Mark Nottingham
Cheers,
--
Mark Nottingham https://www.mnot.net/

[Emily Stark]

Hi Ben,

Thanks for the comments, and apologies for the delay (I've been on parental
leave). I've addressed your comments in
https://github.com/httpwg/http-extensions/commit/7708f6ba2d8841cad9abc5bfc9e663253cb711aa
except for the one about seconds for the reasons that Mark discussed.

Emily

Post by Ben Campbell

Post by Mark Nottingham

Hi Mark,
Just one comment-question :-)

Post by Mark Nottingham

§2.1.3: The guidance for max-age in the security considerations

section

Post by Mark Nottingham

Post by Mark Nottingham

suggests 30 days is a good value. But the directive is specified in

seconds.

Post by Mark Nottingham

Post by Mark Nottingham

Does that make sense? Would a 1 second max-age ever be reasonable? Or

even 30

Post by Mark Nottingham

Post by Mark Nottingham

days + 1 second?

Pretty much everything in HTTP is done at second granularity;

deviating from that would be odd IMO.

Post by Mark Nottingham

I certainly don’t have all the HTTP uses of time intervals loaded in my

head--are time intervals on the order of “1 month” commonly used elsewhere?

Post by Mark Nottingham
In that sort of syntax, no. The desired semantic is often something like

that, but the syntax is almost invariably integer-number-of-seconds.
I’m not entirely sure I follow, but I think you are saying that it is
common to have month-long time intervals that are specified in seconds. Is
that correct?
In any case, it’s a non-blocking comment. If there’s good reason (e.g.
“the parsers all already understand seconds”) to do this in seconds I’m
okay with it.

Post by Mark Nottingham
Cheers,
--
Mark Nottingham https://www.mnot.net/