On 3 May 2011, at 18:49, Richard Hartmann wrote:
> On Tue, May 3, 2011 at 08:09, Dirk-Willem van Gulik
> <dirk-willem.van.gu...@bbc.co.uk> wrote:
>
> > a) Make SSL only the default (ideally with client cert on as well).
>
> Sounds good to me.
>
> > b) Postulate that one port lower there is an optional HTTP port (OFF,
> > or tied to localhost).
>
> The IETF _strongly_ prefers STARTTLS over separate TLS/non-TLS ports.
> If you ever want to get an IANA assignment, you are pretty much
> required to support STARTTLS unless you are working with legacy
> protocols.
>
Actally - that is a very good point for anything non REST/http.
> Using STARTTLS and requiring TLS by default seems like a good option
> for the medium term, to me.
>
Right - but I think it is fair to assume that any IAB concerns would only apply
to two way chatty protocols. A pure 'rest' one-shot stateless protocol would
not be burdened with a STARTTLS and all the risks that entails.
Dw
_______________________________________________
Mailing list: https://launchpad.net/~openstack
Post to : openstack@lists.launchpad.net
Unsubscribe : https://launchpad.net/~openstack
More help : https://help.launchpad.net/ListHelp
