Re: [websec] handling STS header field extendability

2012-08-27 Thread Paul Hoffman
On Aug 27, 2012, at 1:28 PM, Yoav Nir wrote: > With no hats: let's not choose a policy for a registry that we are not > setting up, especially since we're not even sure that it's ever going to be > set up. > > We can leave it to the first extension document to set up the registry and > policy

Re: [websec] handling STS header field extendability

2012-08-27 Thread Yoav Nir
With no hats: let's not choose a policy for a registry that we are not setting up, especially since we're not even sure that it's ever going to be set up. We can leave it to the first extension document to set up the registry and policy. If that document ever comes. Yoav On Aug 27, 2012, at 11

Re: [websec] handling STS header field extendability

2012-08-27 Thread Tobias Gondrom
Hello dear websec fellows, we have so far only very few comments regarding this. If you feel strongly either way, please say so ASAP, within the next 5 days (until Sep-1), otherwise we will have to go with the few comments we received to judge consensus based on them. Thank you, Tobias On

Re: [websec] handling STS header field extendability

2012-08-27 Thread =JeffH
On 08/20/2012 10:55 AM, =JeffH wrote:> Thanks for the clarification Barry. Yes, this question is in response to Ben > Campbell's review comment (which I was going to note, but you took care of it :) > > > "We need to decide on an IANA policy *or* explicitly decide that we > > don't want to cho