Subject: [regext] rfc7484bis: https only?

From: "Marc Blanchet" <[email-masked]>
Date: Fri, 21 Aug 2020 12:26:44 -0400

Hello,
  for the rdap bootstrap registries, there has been (well since the very 
beginning of the work) discussions about only supporting https URLs. 
I’m happy to make it mandatory. Is there a working group agreement on 
this? Please speak up if you don’t agree (i.e. you still want no TLS 
http).

Regards, Marc.

---

From: "Patrick Mevzek" <[email-masked]>
Date: Fri, 21 Aug 2020 11:59:33 -0500

> this? Please speak up if you don’t agree (i.e. you still want no TLS 

I would agree with saying TLS is mandatory... only if followed by either recommendations
or link to proper RFC/Internet-Draft giving guidance and minimum requirements,
because TLS enabled with TLS 1.0 only for example, or using deprecated algorithms,
or with a self-signed server certificate (it would be ok if coupled with DANE) is not really useful TLS.

So probably a reference at least to BCP195.

Also,
https://www.icann.org/en/system/files/files/rdap-technical-implementation-guide-15feb19-en.pdf
§1.2 already has "The RDAP service MUST be provided over HTTPS only."
so that will already cover a not small amount of entries in the bootstrap registry.

-- 
  Patrick Mevzek
  [email-masked]

---

From: Peter Koch <[email-masked]>
Date: Fri, 21 Aug 2020 20:02:38 +0200

On Fri, Aug 21, 2020 at 12:26:44PM -0400, Marc Blanchet wrote:

> beginning of the work) discussions about only supporting https URLs. I’m
> happy to make it mandatory. Is there a working group agreement on this?
> Please speak up if you don’t agree (i.e. you still want no TLS http).

to a certain extent, this registry is mis-homed anyway, but on this question
in particular I do not think that the IETF is the competent body to make
that (policy) decision.

-Peter