Subject: Re: [httpwg/http-extensions] Make the intro to http2-encryption clearer about the scope (#301)

From: HTTP issue updates <[email-masked]>
Date: Mon, 20 Feb 2017 16:59:32 -0800

mnot requested changes on this pull request.

Looks pretty good to me, some tweaks here.

>  passive attacks.
 
-Opportunistic Security {{RFC7435}} does not provide the same guarantees as using TLS with `https`
-URIs; it is vulnerable to active attacks, and does not change the security context of the
+Opportunistic Security does not provide the same guarantees as using TLS with `https`
+URIs; Opportunistic Security is vulnerable to active attacks, and does not change the security context of the

I think this would read more clearly if it were just "...URIs, because it is vulnerable..."

> @@ -64,16 +64,18 @@ for this draft can be found at <https://github.com/httpwg/http-extensions/labels
 # Introduction
 
 This document describes a use of HTTP Alternative Services {{RFC7838}} to decouple
-the URI scheme from the use and configuration of underlying encryption, allowing a `http` URI
-{{RFC7230}} to be accessed using Transport Layer Security (TLS) {{RFC5246}} opportunistically.
-
-Serving `https` URIs requires avoiding Mixed Content {{W3C.CR-mixed-content-20160802}}, which is
-problematic in many deployments. This document describes a usage model whereby sites can serve
-`http` URIs over TLS, thereby avoiding these issues, while still providing protection against
+the URI scheme from the use and configuration of underlying encryption.
+It allows HTTP/2 {{RFC7540}} to access a `http` URI
+{{RFC7230}} using Transport Layer Security (TLS) {{RFC5246}}
+with Opportunistic Security {{RFC7435}}.
+
+This document describes a usage model whereby sites can serve
+`http` URIs over TLS, thereby avoiding the problem of serving 
+Mixed Content (describe in {{W3C.CR-mixed-content-20160802}}) while still providing protection against

describe**d**

> @@ -64,16 +64,18 @@ for this draft can be found at <https://github.com/httpwg/http-extensions/labels
 # Introduction
 
 This document describes a use of HTTP Alternative Services {{RFC7838}} to decouple
-the URI scheme from the use and configuration of underlying encryption, allowing a `http` URI
-{{RFC7230}} to be accessed using Transport Layer Security (TLS) {{RFC5246}} opportunistically.
-
-Serving `https` URIs requires avoiding Mixed Content {{W3C.CR-mixed-content-20160802}}, which is
-problematic in many deployments. This document describes a usage model whereby sites can serve
-`http` URIs over TLS, thereby avoiding these issues, while still providing protection against
+the URI scheme from the use and configuration of underlying encryption.
+It allows HTTP/2 {{RFC7540}} to access a `http` URI

This is worded oddly. Suggest "It allows a `http` URI to be accessed using HTTP/2 {{RFC7230}} and Transport Layer..."

> @@ -48,7 +48,7 @@ informative:
 
 --- abstract
 
-This document describes how `http` URIs can be accessed using Transport Layer Security (TLS) to
+This document describes how `http` URIs can be accessed using Transport Layer Security (TLS) in HTTP/2 to

in -> and

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/pull/301#pullrequestreview-22859928

---

From: HTTP issue updates <[email-masked]>
Date: Mon, 20 Feb 2017 17:00:11 -0800

@martinthomson thoughts?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/pull/301#issuecomment-281216234

---

From: HTTP issue updates <[email-masked]>
Date: Mon, 20 Feb 2017 17:01:06 -0800

paulehoffman commented on this pull request.

WFM

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/pull/301#discussion_r102114637

---

From: HTTP issue updates <[email-masked]>
Date: Mon, 20 Feb 2017 17:09:28 -0800

martinthomson commented on this pull request.

 # Introduction

"a" or "an" for "http"?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/pull/301#discussion_r102115173

---

From: HTTP issue updates <[email-masked]>
Date: Mon, 20 Feb 2017 17:20:27 -0800

Seems fine, with the edits Mark suggested.  I'll merge and make those changes unless Paul gets to it first.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/pull/301#issuecomment-281218741

---

From: HTTP issue updates <[email-masked]>
Date: Mon, 20 Feb 2017 18:42:51 -0800

Merged #301.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/pull/301#event-970036522