Subject: [webfinger] Simplifying and unjamming WebFinger

From: Tim Bray <[email-masked]>
Date: Fri, 14 Jun 2013 10:16:32 -0700

I’ve been following the endless back and forth on this with a feeling of
despair... people seem to be talking back and forth past each other.  Lots
of people think there are problems, Paul thinks there are no problems.

Back in the day, when I first heard of WebFinger, it was the simplest thing
imaginable: Put in an email address and get back some pointers to IDPs or
whatever.  Somewhere along the way, it morphed into getting metadata about
any Resource.  Which meant that you couldn’t just use an email address, you
had to turn it into a URI.

And thus the problem in the spec.  You have to figure out which URI scheme
to use (acct:, mailto:, device:) and this will affect the output in ways
that have to be specified in Other Places.

But I don’t have a general-purpose problem about wanting metadata for
arbitrary URIs.  I have several immediate pressing problems for retrieving
metadata about  email addresses.   The former is now seriously getting in
the way of the latter.

So, how about a WebFinger light, in which the form of the query is

/.well-known/wf-lite?email=[email-masked]

Which yields a JRD.  You could still have the rel-selection and so on. It
would be easy to understand. It would be self-contained. The draft would
shrink in size dramatically. It would be instantly usable by OpenID
Connect.  It would probably sail through the IESG.

 -T

---

From: Eric Mill <[email-masked]>
Date: Fri, 14 Jun 2013 13:34:01 -0400

A thousand times yes. Webfinger is the small beautiful idea that could, and
this endless back-and-forth is sucking the life out of it.

I haven't been involved in the spec work, but I did do some actual
evangelism <http://www.youtube.com/watch?v=Y26c9MNQLyc> to the Rails
community soon after Webfinger began - *3 years ago*. But that's all I did
- once the spec slowed down to a crawl and got lost in the weeds, I
couldn't sustain that energy. I'm sure I'm not the only one to be affected
that way.

email -> metadata. Make it possible to own your identity with your email.
That's what we need.

-- Eric

On Fri, Jun 14, 2013 at 1:16 PM, Tim Bray <[email-masked]> wrote:

> Back in the day, when I first heard of WebFinger, it was the simplest
> thing imaginable: Put in an email address and get back some pointers to
> IDPs or whatever.  Somewhere along the way, it morphed into getting
> metadata about any Resource.  Which meant that you couldn’t just use an
> email address, you had to turn it into a URI.
>
> _______________________________________________
> webfinger mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/webfinger
>
>

-- 
@konklone <http://twitter.com/konklone> | konklone.com |
sunlightfoundation.com | awesomefoundation.org

---

From: Brad Fitzpatrick <[email-masked]>
Date: Fri, 14 Jun 2013 10:51:53 -0700

3 years ago? That's recent! I've been watching this
over-specification-wankery for much longer than that.

Which is to say: I agree with Tim.

Stop inventing unnecessary problems and ship something small and useful and
composable.

On Fri, Jun 14, 2013 at 10:34 AM, Eric Mill <[email-masked]> wrote:

> A thousand times yes. Webfinger is the small beautiful idea that could,
> and this endless back-and-forth is sucking the life out of it.
>
> community soon after Webfinger began - *3 years ago*. But that's all I
> did - once the spec slowed down to a crawl and got lost in the weeds, I
>> And thus the problem in the spec.  You have to figure out which URI
>> scheme to use (acct:, mailto:, device:) and this will affect the output
>> in ways that have to be specified in Other Places.
>>

---

From: Mike Jones <[email-masked]>
Date: Fri, 14 Jun 2013 18:19:47 +0000

Tim, I’m not sure where the feeling of despair comes from, other than finishing things always seems to take longer than it should.  (I agree with you there.)

That said, I can’t support changes to WebFinger that restrict it’s applicability to only e-mail addresses, and if you’re being consistent with your desire to have OpenID Connect succeed, neither can you.  OpenID Connect uses the ability of WebFinger to return metadata about URIs that are not e-mail addresses.  See http://openid.net/specs/openid-connect-discovery-1_0.html#URLSyntax and http://openid.net/specs/openid-connect-discovery-1_0.html#host.port.example for example uses with URLs.

My take-away from this is that those of us who care about finishing WebFinger should double down in our participation to constructively help finish the IESG review process.  I would only despair if we went back to the drawing board, because that would set us back by years and destroy the chance of finishing something that’s nearly done and has been demonstrated to meet open discovery needs in practice.

                                                                -- Mike

From: [email-masked] [mailto:[email-masked]] On Behalf Of Tim Bray
Sent: Friday, June 14, 2013 10:17 AM
To: [email-masked]
Subject: [webfinger] Simplifying and unjamming WebFinger

I’ve been following the endless back and forth on this with a feeling of despair... people seem to be talking back and forth past each other.  Lots of people think there are problems, Paul thinks there are no problems.
Back in the day, when I first heard of WebFinger, it was the simplest thing imaginable: Put in an email address and get back some pointers to IDPs or whatever.  Somewhere along the way, it morphed into getting metadata about any Resource.  Which meant that you couldn’t just use an email address, you had to turn it into a URI.

And thus the problem in the spec.  You have to figure out which URI scheme to use (acct:, mailto:, device:) and this will affect the output in ways that have to be specified in Other Places.
But I don’t have a general-purpose problem about wanting metadata for arbitrary URIs.  I have several immediate pressing problems for retrieving metadata about  email addresses.   The former is now seriously getting in the way of the latter.
So, how about a WebFinger light, in which the form of the query is
/.well-known/wf-lite?email=[email-masked]<mailto:[email-masked]>
Which yields a JRD.  You could still have the rel-selection and so on. It would be easy to understand. It would be self-contained. The draft would shrink in size dramatically. It would be instantly usable by OpenID Connect.  It would probably sail through the IESG.

 -T

---

From: Melvin Carvalho <[email-masked]>
Date: Fri, 14 Jun 2013 20:31:48 +0200

> /.well-known/wf-lite?email=[email-masked]

IMHO webfinger light would be:

/.well-known/acct/bob

The server MUST return JRD, but MAY return other representations.

---

From: Evan Prodromou <[email-masked]>
Date: Fri, 14 Jun 2013 21:09:20 -0400

Trying to change the spec at this late date is not the way to get it to 
ship.

I realize the intentions are good but there are probably better ways to 
get us to release this spec.

-Evan

---

From: Gonzalo Salgueiro <[email-masked]>
Date: Fri, 14 Jun 2013 21:50:17 -0400

Finally, a voice of reason has spoken.  Thanks, Mike!

When we are in the process of clearing the final two DISCUSSes in IESG review is not the time to start over from scratch.  We spent years of very long discussion coming to consensus on the document we have now....one, I might add, that we were all supportive of.  Pete Resnick is asking some reasonable questions regarding the document providing enough client instruction on URI selection for the purposes of information retrieval.  Let's just decide if we need additional text and,when possible, offer it concretely to speed things along. 

Gonzalo

---

From: Eric Mill <[email-masked]>
Date: Fri, 14 Jun 2013 23:03:15 -0400

In that case, how about a deadline?

On Fri, Jun 14, 2013 at 9:50 PM, Gonzalo Salgueiro <[email-masked]>wrote:

> When we are in the process of clearing the final two DISCUSSes in IESG
> review is not the time to start over from scratch.  We spent years of very
> long discussion coming to consensus on the document we have now....one, I
> might add, that we were all supportive of.  Pete Resnick is asking some
> reasonable questions regarding the document providing enough client
> instruction on URI selection for the purposes of information retrieval.
>  Let's just decide if we need additional text and,when possible, offer it
> concretely to speed things along.
>
> Gonzalo
>
>
> > Tim, I’m not sure where the feeling of despair comes from, other than
> finishing things always seems to take longer than it should.  (I agree with
> you there.)
> >
> > That said, I can’t support changes to WebFinger that restrict it’s
> applicability to only e-mail addresses, and if you’re being consistent with
> your desire to have OpenID Connect succeed, neither can you.  OpenID
> Connect uses the ability of WebFinger to return metadata about URIs that
> are not e-mail addresses.  See
> http://openid.net/specs/openid-connect-discovery-1_0.html#URLSyntax and
> http://openid.net/specs/openid-connect-discovery-1_0.html#host.port.examplefor example uses with URLs.
> >
> > My take-away from this is that those of us who care about finishing
> WebFinger should double down in our participation to constructively help
> finish the IESG review process.  I would only despair if we went back to
> the drawing board, because that would set us back by years and destroy the
> chance of finishing something that’s nearly done and has been demonstrated
> to meet open discovery needs in practice.
> >
> >                                                                 -- Mike
> >
> > Which yields a JRD.  You could still have the rel-selection and so on.
> It would be easy to understand. It would be self-contained. The draft would

---

From: Gonzalo Salgueiro <[email-masked]>
Date: Fri, 14 Jun 2013 23:15:30 -0400

Eric - 

I'm a huge advocate of increased agility in the IETF standardization process and I certainly wish we had the luxury of a deadline, but I'm afraid that IESG review doesn't work that way.  We're going to have roll up our sleeves and do it the old-fashioned way...come to an agreement that satisfies the ADs, yet retains our agreed upon consensus of what the Webfinger protocol/framework should be.  Mike's most recent email providing different options to break this gridlock is a great start.

Gonzalo

On Jun 14, 2013, at 11:03 PM, Eric Mill <[email-masked]> wrote:

> On Fri, Jun 14, 2013 at 9:50 PM, Gonzalo Salgueiro <[email-masked]> wrote:
> @konklone | konklone.com | sunlightfoundation.com | awesomefoundation.org