[NNTP] AUTHINFO diffs

[Russ Allbery]

Ken Murchison <ken at oceana.com> writes:

> Right, the suggestions are to wait for the updated DIGEST-MD5 or go with
> TLS+PLAIN.  We just need to select at least one mandatory to implement
> (not necessarily mandatory to use) mechanism, so that two conforming
> implementations can always be configured to interoperate.

> IMO, PLAIN is the simplest to implement, but this is going to then
> mandate that every implementation also supports TLS.  The only mechanism
> other than PLAIN or DIGEST-MD5 which we could mandate would probably be
> GSSAPI.

I would rather not require TLS.  Adding SASL support is significantly
easier than adding TLS support.  Requiring GSSAPI feels like a non-starter
to me as well; some Cyrus SASL builds don't even include GSSAPI with the
default module set due to the other library dependencies.

This makes me think that we should probably wait for DIGEST-MD5, as much
as I dislike that.  :/  Do we have any feel for how long that delay is
going to be?

-- 
Russ Allbery (rra at stanford.edu)             <http://www.eyrie.org/~eagle/>