non-default ports

[mnot]

In httpwg/http-extensions#455, @martinthomson puts forth that using .well-known on a non-default port in your application is bad practice.

is it?

[martinthomson]

That was in the context of discovery using .well-known, which is already bad practice. A protocol is probably OK with bootstrapping on a well-defined port it a name is all it has, but allowing arbitrary ports to speak with authority seems risky (noting of course that we don't authenticate ports usually, so it can't be so bad).