Subject: [webfinger] consensus declaration on HTTPS only

From: Salvatore Loreto <[email-masked]>
Date: Mon, 17 Dec 2012 22:20:21 +0100

Thanks everybody for your participation in the "HTTPS only vs 
HTTPS-and-HTTP" discussion
and for providing feedback and alternatives.

In light of the last two weeks mail discussion on the subject, spread 
among different threads,
I, as chair responsible for this draft, am declaring rough consensus on 
the "HTTPS only" option.

My reading of the mail discussion is that at this point there is rough 
consensus to specify
only WebFinger over HTTPS because

1) it does not open room to any unknown and/or not enough analyzed 
security risks,
     allowing at the same time to finalize and deploy the first version 
of WebFinger quite soon

2) the work to support plain HTTP,  while is recognized to be important 
and necessary,
     still requires quite a lot of discussions  both to
     come to an agreement on which approach to use among the different 
ones on the table and
     to fully investigate all the security aspects and implications.
     For those reasons is much better to specify only the secure way in 
the first version of WebFinger but at
     the same time start to work on the non-secure modes on a separate 
document

Salvatore Loreto

-- 
Salvatore Loreto, PhD
www.sloreto.com

---

From: Melvin Carvalho <[email-masked]>
Date: Tue, 18 Dec 2012 00:42:55 +0100

On 17 December 2012 22:20, Salvatore Loreto
<[email-masked]>wrote:

>     allowing at the same time to finalize and deploy the first version of
> WebFinger quite soon
>
>     come to an agreement on which approach to use among the different ones
> on the table and
>     For those reasons is much better to specify only the secure way in the
> first version of WebFinger but at

+1

>
>
> Salvatore Loreto
>
> --
> Salvatore Loreto, PhD
> www.sloreto.com
>
> ______________________________**_________________
> webfinger mailing list
> [email-masked]
> https://www.ietf.org/mailman/**listinfo/webfinger<https://www.ietf.org/mailman/listinfo/webfinger>
>

---

From: Evan Prodromou <[email-masked]>
Date: Tue, 18 Dec 2012 13:01:33 -0500

On 12-12-17 04:20 PM, Salvatore Loreto wrote:
> I, as chair responsible for this draft, am declaring rough consensus 
> on the "HTTPS only" option.
>
> 2) the work to support plain HTTP,  while is recognized to be 
> important and necessary,
+1

-- 
Evan Prodromou, CEO and Founder, StatusNet Inc.
1124 rue Marie-Anne Est #32, Montreal, Quebec, Canada H2J 2B7
E: [email-masked] P: +1-514-554-3826

---

From: ☮ elf Pavlik ☮ <[email-masked]>
Date: Tue, 18 Dec 2012 18:05:44 +0000

+1

---

From: Nick Jennings <[email-masked]>
Date: Tue, 18 Dec 2012 19:50:04 +0100

+1

On Tue, Dec 18, 2012 at 7:05 PM, ☮ elf Pavlik ☮
<[email-masked]> wrote:
> _______________________________________________
> webfinger mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/webfinger