Subject: Re: [apps-discuss] content inspection in absence of media type, was: APPSDIR review of draft-ietf-httpbis-p2-semantics-24

From: [email-masked] (Henry S. Thompson)
Date: Mon, 04 Nov 2013 15:41:22 +0000

Mark Nottingham writes:

> Consensus around this text was particularly hard-won; unless there
> is a very good reason to make a change, I'd rather not risk falling
> into that rat-hole again.

And, I should add in case it helps at all, that the W3C TAG was
involved in the extensive discussions which resulted in this text.

I also think the fact that it is where it is, in 3.1.1.5, does matter.

But recapitulating and/or referencing it in the Security
Considerations section would of course be fine, and indeed probably
desireable.

ht
-- 
       Henry S. Thompson, School of Informatics, University of Edinburgh
      10 Crichton Street, Edinburgh EH8 9AB, SCOTLAND -- (44) 131 650-4440
                Fax: (44) 131 650-4587, e-mail: [email-masked]
                       URL: http://www.ltg.ed.ac.uk/~ht/
 [mail from me _always_ has a .sig like this -- mail without it is forged spam]

---

From: Larry Masinter <[email-masked]>
Date: Mon, 4 Nov 2013 08:09:24 -0800

I'd like to point out that the topic of consistent content inspection was discussed in the websec working group via:
http://tools.ietf.org/html/draft-ietf-websec-mime-sniff-03
which was abandoned in the IETF and taken up by WHATWG in 
http://mimesniff.spec.whatwg.org/.
The "bugs" filed in IETF tracker:
http://trac.tools.ietf.org/wg/websec/trac/query?component=mime-sniff
and discussed at IETF 82 Taipei
http://tools.ietf.org/agenda/82/slides/websec-2.pdf

were subsequently reproduced in the WHATWG tracker

https://www.w3.org/Bugs/Public/show_bug.cgi?id=19746

Ideally, the "magic number" entry in the Media Type registry would be retargeted to give instructions and prioritization for content recognition, especially in cases (such as ftp: and file: access) where there is no channel for content-type transmission.  

Fixing content-type sniffing goes beyond http and should be addressed directly. 

Larry
--
http://larry.masinter.net