Received: from localhost (daemon@localhost) by CS.UTK.EDU with SMTP (cf v2.9s-UTK) id WAA11906; Wed, 5 Aug 1998 22:02:57 -0400 (EDT) Received: by cs.cs.utk.edu (bulk_mailer v1.10); Wed, 5 Aug 1998 22:02:37 -0400 Received: by CS.UTK.EDU (cf v2.9s-UTK) id WAA11839; Wed, 5 Aug 1998 22:02:37 -0400 (EDT) Received: from koobera.math.uic.edu (koobera.math.uic.edu [131.193.178.247]) by CS.UTK.EDU with SMTP (cf v2.9s-UTK) id WAA11827; Wed, 5 Aug 1998 22:02:33 -0400 (EDT) Received: (qmail 26766 invoked by uid 666); 6 Aug 1998 02:02:50 -0000 Date: 6 Aug 1998 02:02:50 -0000 Message-ID: <19980806020250.26764.qmail@cr.yp.to> Mail-Followup-To: drums@cs.utk.edu, sob@harvard.edu From: "D. J. Bernstein" To: drums@cs.utk.edu, sob@harvard.edu Subject: RFC 2119 and paternalistic market interference References: Chris Newman writes: > MUST NOT write the user's password unencrypted to disk That's a violation of standard corporate policy. To the extent that users _want_ this feature, your requirement is useless. They'll select implementations that have the feature. To the extent that users _don't_ want this feature---because, for example, the boss requires that it be turned off---your requirement is imposing unnecessary costs upon implementors. You presented this as an example of why RFC 2119 is wrong. I see it as an example of why RFC 2119 is right. You have no business making requirements in this area. Butt out! ---Dan Binary qmail distributions are allowed! http://pobox.com/~djb/qmail/dist.html