> But nonetheless spec authors picked compatibility over security. I would not. Most of the compatibility compromises don't seem to sacrifice security - except

> But nonetheless spec authors picked compatibility over security. I would not. Most of the compatibility compromises don't seem to sacrifice security - except perhaps for increased attack surface, and a more complicated spec (but I'm not sure that leads to a more complicated implementation, so much as it's more thoroughly covering any downgrade dance?) If there are more security sacrifices to achieve compatibility, I agree with you - that's bad.