ietf-nntp NNTP AUTH draft update

[Clive D.W. Feather]

Chris Newman said:
> x5x vs. x8x resolution?
> -----------------------
> Here's the outline of the changes I plan in the next version based on
> discussions at the IETF meeting:
> 
> Compliant clients MUST issue "LIST EXTENSIONS" prior to using "AUTHINFO".
> If the "LIST EXTENSIONS" command fails, clients MAY attempt to use
> "AUTHINFO USER"/"AUTHINFO PASS" but should be aware that the server is
> likely to use x8x response codes in that case.
> 
> Servers MUST use the x5x response codes to "AUTHINFO" if the client issued
> a "LIST EXTENSIONS" command.  However, they MAY treat "AUTHINFO
> USER"/"AUTHINFO PASS" received prior to a "LIST EXTENSIONS" command as the
> pre-standard version of those commands and return commonly used private-use
> x8x response codes (which will be listed in an appendix).

No, no, no ! That is the most horrible broken bogus design I've seen in ages.

LIST EXTENSIONS is supposed to tell you what the server is capable of. As
such, it shouldn't affect the internal state of the server at all. There's
certainly nothing in the present NNTP draft to even suggest that it might
affect (as opposed to reflect) server state.

If backwards compatibility of the old form is vital, then use a new name
for the version with x5x codes:

    AUTHINFO STDUSER
or  AUTHINFO USER5

Or else state that compatibility with old AUTHINFO USER implementations
isn't important. But not this hybrid that relies on the client knowing
about one feature and not knowing about another.

-- 
Clive D.W. Feather  | Work:  <clive at demon.net>   | Tel: +44 20 8371 1138
Internet Expert     | Home:  <clive at davros.org>  | Fax: +44 20 8371 1037
Demon Internet      | WWW: http://www.davros.org | Mobile: +44 7973 377646