Re: [TLS] To API or not (Re: TLS renegotiation issue)

[Nicolas Williams <Nicolas.Williams at sun.com>]

On Sat, Nov 07, 2009 at 07:42:10PM -0600, Marsh Ray wrote:
> Blumenthal, Uri - 0662 - MITLL wrote:
> > IETF can't write precise API because those are application-specific.
> 
> s/can't/shouldn't/   ?

RFC2744 (GSS-API v2u1, C-Bindings), for example, specifies a C API, for
_applications_; there's also Java bindings.  SCTP is another example.

The IETF most certainly can, and does, define APIs for _application_ use.

> It bugs me the way w3c goes as far as specifying that some APIs must use
> UTF-16 host-endian for their string representation, even for things
> usually accessed from scripting languages.

Interesting.  Sounds like a mistake.

> > I think that abstract interfaces would be useful for TLS.
> 
> I agree.
> 
> Somebody would have noticed that they were adding a new layer to the
> model, and it would have forced an interface change which either would
> have been rejected or documented properly.

I think so too.

Nico
--