>The fact that scenarios exist where security is not
>necessary, do not obviate the need for the standard
>to specify security as a requirement
I would restate this, slightly... "The fact that scenarios exist where
security is not necessary does not obviate the need for the standard
to SPECIFY THE REQUIREMENTS FOR SECURITY".
I think the IETF is trying to tell us "not to build a protocol without
addressing security". We are interpreting this to mean "do not allow an=
implementation which is not secure".
Is every web server, on the Internet today, required to support HTTPS?
Why? Many servers would have no need to be secure.
MAKING every IPP printer behave in a secure fashion could be misleading=