Hacker News Reader

Comment by XorNot | Hacker News Reader

Isn't this kind of a flaw in the RFC process? Shouldn't we have been amending the original spec this whole time and tagging new versions, source control style?

The legal system has a similar problem, though it's ironically even more obvious because amendments to laws will be something like "Page 143, Paragraph 7, Sentence 4 will now read ..." which is just literally writing out a diff.

I'm feeling salty at the moment because for various reasons I'm deep in the OpenID Connect specifications right now, and while they're available the overall formatting, layout and hyperlinking is just awful for rapidly conveying meaning (and like all things OAuth the spec by everyone else also can't be trusted).

Surely we can and should do better.

View on HN

Yeah. This is part of the issue that legislative codification is supposed to deal with. A new law is often making a diff to the old one, and you can either keep a pile of diffs in hand and work out what the current state is in your head, or you can try to make sure there is a 'master version' (the Code) which you keep patching and can check out a fresh version of when you need to read it.

England and Wales (my home jurisdiction) doesn't have either criminal or civil codes as such, but it does do a fair number of consolidating statutes - almost exactly like this new RFC. The Sexual Offences Act 2003, for example, made some changes but also consolidated the current state of sexual offences law into a single Act[0]. (You can also now see the 'as amended' versions on the web for all Acts, which is useful. If you want to know which bits of Magna Carta are still in force, well now you can[1]. This Act has the additional problem that source control was fairly shoddy in 1297 and it's not entirely clear what the actual text in force is...)

[0]: https://www.legislation.gov.uk/ukpga/2003/42 [1]: https://www.legislation.gov.uk/aep/Edw1cc1929/25/9

That's mostly just the case of a long-running system: It was a sensible choice in the day, and apparently it's held up, considering we're talking about an RFC revised 41 years later.

I do wish it was more clear how one could engage in the process: I will literally not sleep soundly at night until the HSTS standard is revised to remove it's malicious component (the "no user recourse" clause), but I also... really have no idea where to start on getting it amended.

Reply on news.ycombinator.com