<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><br><div><div>On 3 May 2011, at 18:49, Richard Hartmann wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite">
<div>
<!-- Converted from text/plain format --><p><font size="2">On Tue, May 3, 2011 at 08:09, Dirk-Willem van Gulik<br>
<<a href="mailto:dirk-willem.van.gulik@bbc.co.uk">dirk-willem.van.gulik@bbc.co.uk</a>> wrote:<br>
<br>
> a) Make SSL only the default (ideally with client cert on as well).<br>
<br>
Sounds good to me.<br>
<br>
> b) Postulate that one port lower there is an optional HTTP port (OFF, or tied to localhost).<br>
<br>
The IETF _strongly_ prefers STARTTLS over separate TLS/non-TLS ports.<br>
If you ever want to get an IANA assignment, you are pretty much<br>
required to support STARTTLS unless you are working with legacy<br>
protocols.</font></p></div></blockquote>Actally - that is a very good point for anything non REST/http.<br><blockquote type="cite"><div><p><font size="2">Using STARTTLS and requiring TLS by default seems like a good option<br>
for the medium term, to me.<br></font></p></div></blockquote></div>Right - but I think it is fair to assume that any IAB concerns would only apply to two way chatty protocols. A pure 'rest' one-shot stateless protocol would not be burdened with a STARTTLS and all the risks that entails.<div><br><div>Dw</div></div></body></html>