Skip to content

Add note about implementations that removed support for "zip" - #33

Merged
yaronf merged 2 commits into
mainfrom
mbj-compression
Jan 12, 2026
Merged

Add note about implementations that removed support for "zip"#33
yaronf merged 2 commits into
mainfrom
mbj-compression

Conversation

@selfissued

Copy link
Copy Markdown
Collaborator

Fixes #31

@yaronf yaronf left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I disagree with the premise here: the BCP formally Updates 7519 (and would Update 7516 if we asked for it), and so I don't think we are committed to retain every last feature if we believe it raises security issues.

We are pointing out a security problem with systems and libraries, and I don't think the position "SHOULD NOT compress but still MUST support zip" is consistent.

@selfissued

selfissued commented Dec 21, 2025

Copy link
Copy Markdown
Collaborator Author

Actually, the BCP doesn't update JWE [RFC 7516]. It's not within our remit to make breaking changes to a spec in another working group. That would need to be done by new spec work in the JOSE working group, with consensus of that working group. It is within our scope to recommend that problematic features not be used.

@dickhardt

Copy link
Copy Markdown
Collaborator

Checking in on where we are at on this. The updates look good to me. @bc-pi now is the time to make any additional suggestions!

@yaronf

yaronf commented Jan 9, 2026

Copy link
Copy Markdown
Collaborator

While I understand the motivation for the paragraph that describes the interop issues with libraries that removed support for compression, I'm afraid that this paragraph significantly dilutes our message. As a BCP we are explaining why compression is problematic, let's keep it at that and have developers draw their own conclusions on pros and cons of supporting this functionality.

So, I suggest to retain the added reference but remove the compatibility paragraph.

@yaronf
yaronf merged commit fce1a61 into main Jan 12, 2026
2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Brian's WGLC comment - compression

3 participants