Subject: [apps-discuss] Comments on new procedure for URI scheme registration (BCP35/RFC7595)

From: Graham Klyne <[email-masked]>
Date: Thu, 16 Jul 2015 19:35:01 +0100

I've just responded in my role of DE to a first request to review a URI scheme 
registration under the new procedure defined by BCP35/RFC7595 [1], and I think 
this has uncovered a small problem.

[1] https://tools.ietf.org/html/rfc7595

Strictly, the request did not need to come to me, since it was for a provisional 
registration, which should be treated thus:

[[
    1.  IANA checks the submission for completeness; if required sections
        of the scheme registration request are missing or any citations
        are not correct, IANA will reject the registration request.  A
        registrant can resubmit a corrected request if desired.

    2.  If the request is for 'provisional' registration and no entry
        already exists in the current registry for the same name, IANA
        adds the registration to the registry under the First Come First
        Served policy.
]]
-- https://tools.ietf.org/html/rfc7595#section-7.2

But the procedure document also says:
[[
    o  The scheme definition SHOULD include clear security considerations
       (Section 3.7) or explain why a full security analysis is not
       available (e.g., in a third-party scheme registration).

    o  If the scheme definition does not meet the guidelines laid out in
       Section 3, the differences and reasons SHOULD be noted.
]]
-- https://tools.ietf.org/html/rfc7595#section-4

The problem I see is that there is no way to check the SHOULD requirements here 
(in sect 4), in particular with regard to security considerations, since these 
are no longer part of the registration template but are expected to be in the 
defining document:

[[
    The previous version of this specification required the following
    additional fields in a scheme registration request.  These fields are
    no longer part of the template.  The answers instead belong in the
    scheme specification.

    :

    Security considerations:
      See Section 3.7 for guidelines.
]]
-- https://tools.ietf.org/html/rfc7595#section-7.4

My understanding is that IANA are not expected to read and understand the actual 
specification document, so they cannot check this, and the DE should not see 
these registration requests.

...

My suggestion is that the apparently normative language in section 4 be treated 
as advice to be followed by the submitter, and that a future revision of the 
procedure makes this clearer.

#g
--

---

From: Dave Thaler <[email-masked]>
Date: Thu, 16 Jul 2015 18:41:08 +0000

> -----Original Message-----
> From: Graham Klyne [mailto:[email-masked]]
> Sent: Thursday, July 16, 2015 11:35 AM
> To: [email-masked]; Dave Thaler
> Cc: [email-masked]
> Subject: Comments on new procedure for URI scheme registration
> (BCP35/RFC7595)
> 
> registration under the new procedure defined by BCP35/RFC7595 [1], and I
> think this has uncovered a small problem.
> 
> The problem I see is that there is no way to check the SHOULD requirements
> here (in sect 4), in particular with regard to security considerations, since these

I agree.   I don't think this was intentional.   The last three bullets of section 4
fall into this category:
>   o  If no permanent, citable specification for the scheme definition
>      is included, credible reasons for not providing it SHOULD be
>      given.
>

Graham would you like to file an errata?

The normative language in an earlier bullet still applies:
>   o  Contact information identifying the person supplying the
>      registration must be included.  Previously unregistered schemes
>      discovered in use can be registered by third parties (even if not
>      on behalf of those who created the scheme).  In this case, both
>      the registering party and the scheme creator SHOULD be identified.

So the errata should refer only the last three bullets, not all of section 4.

Dave

---

From: Graham Klyne <[email-masked]>
Date: Fri, 17 Jul 2015 21:50:17 +0100

Erratum submitted.

#g
--

On 16/07/2015 19:41, Dave Thaler wrote:
> _______________________________________________
> apps-discuss mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/apps-discuss
>