OC2 HTTP(no S) Spec

[duncan sfractal.com <duncan@sfractal.com>]

At the plugfest, I implemented the HTTP version of the HTTPS spec. I think there are valid uses of HTTP (without the S) for OpenC2. They just need to be caveated with the fact that HTTP doesnât provide security. Note most of the interworking issues at plugfest had nothing to do with OpenC2 and were just plain old HTTPS cert issues. Besides plugfest testing, I can provide valid usecases for HTTP (eg where SPA transport is sufficient for authentication and transmission privacy is not needed â note this may apply to large number of IoT usecases).

 

I recommend the IC-SC consider creating another transport spec, an âappropriately caveatedâ HTTP spec.

 

Duncan Sparrell

sFractal Consulting LLC

iPhone, iTypo, iApologize

I welcome VSRE emails. Learn more at http://vsre.info/