Subject: Re: [Last-Call] Last Call: <draft-ietf-secevent-http-poll-09.txt> (Poll-Based Security Event Token (SET) Delivery Using HTTP) to Proposed Standard

From: Mark Nottingham <[email-masked]>
Date: Mon, 4 May 2020 16:52:10 +1000

Just two comments, based upon a quick read:

1. In section 2: POST is not specific to HTTP/1.1, and it's not good practice to specify a HTTP version. Just say "HTTP POST".

2. I'm not intimately familiar with the use case, but using POST in this manner precludes caching as well as fan-out (i.e., "collapsed forwarding"). Have you considered just using Atom or a similar event feed structure?

Cheers,

> On 30 Apr 2020, at 9:32 am, The IESG <[email-masked]> wrote:
> 
> 
> The IESG has received a request from the Security Events WG (secevent) to
> consider the following document: - 'Poll-Based Security Event Token (SET)
> Delivery Using HTTP'
>  <draft-ietf-secevent-http-poll-09.txt> as Proposed Standard
> 

--
Mark Nottingham   https://www.mnot.net/

---

From: Benjamin Kaduk <[email-masked]>
Date: Fri, 8 May 2020 17:04:22 -0700

Hi Mark,

> 1. In section 2: POST is not specific to HTTP/1.1, and it's not good practice to specify a HTTP version. Just say "HTTP POST".

Thanks for noting that, it's a good point (and probably just an oversight,
as "HTTP POST" is used sevarl times but "HTTP/1.1 POST" just the once).

> 2. I'm not intimately familiar with the use case, but using POST in this manner precludes caching as well as fan-out (i.e., "collapsed forwarding"). Have you considered just using Atom or a similar…

There's a bit of discussion on this point at
https://tools.ietf.org/html/draft-ietf-secevent-http-push-08#appendix-A,
though Atom itself is not listed there.

-Ben