Re: Security Considerations

[Sam Hartman <hartmans-ietf@xxxxxxx>]

Hi folks.

This has been a long discussion and has helped us all understand our
various points of view, but I think we are no longer making forward
progress.

The IESG discussed this issue during the working group news section of
today's telechat.

The conclusion of those on the call is that in order to meet IETF
interoperability requirements APP must normatively require a mandatory
to implement security mechanism for HTTP authentication.

Thanks again for helping us all understand this complex issue.

There are a lot of related items that came out of this discussion.  I
don't think it would be appropriate to block APP.  However if the
right group of people want to get together and write a security
current practices document for HTTP, that might be useful to future
protocols in the same position as APP.  That effort would need to be
coordinated with several related HTTP efforts that are underway or
being considered.

Sam Hartman
Security Area Director