Subject: Fwd: Last Call: draft-nottingham-site-meta (Defining Well-Known URIs) to Proposed Standard

From: Mark Nottingham <[email-masked]>
Date: Wed, 14 Oct 2009 12:26:02 +1100

Forwarded with permission.

Do people find this interesting? To specify it, we'd just need to  
describe a format (e.g., a space-separated list of tokens).

Cheers,

Begin forwarded message:

> From: Lorrie Faith Cranor <[email-masked]>
> Date: 13 October 2009 12:03:24 AM AEDT
> To: Mark Nottingham <[email-masked]>
> Subject: Re: Last Call: draft-nottingham-site-meta (Defining Well- 
> Known URIs) to Proposed Standard
>
> Hey Mark!
>
> I just saw this... wow an idea that's been kicking around a long  
> time since we introduced the well-known location in P3P. I'm not  
> involved in W3C stuff any more but lurk on some of these lists. It  
> occurs to me that if a lot of applications adopted this, it would be  
> useful to make one query to the .well-known directory to get a list  
> of all the files there so I don't have to play 20 questions with a  
> server to find out what it supports. Depending on how the server is  
> configured a query to http://example.com/.well-known/ might return  
> the list of files in that directory. It might be nice to actually  
> encourage that. The only downside I see is that it might make it  
> easier for an attacker to find out what you run and know what to  
> exploit, but without that the attacker could still play 20 questions  
> and find out.

--
Mark Nottingham     http://www.mnot.net/

---

From: Eran Hammer-Lahav <[email-masked]>
Date: Tue, 13 Oct 2009 18:53:54 -0700

I think it would be premature to define this before we have a few items in the registry and see how it is used. It doesn't offer significant value (today) other than a small optimization for protocols looking for multiple well-known documents.

But if we find the registry popular and new applications make use of multiple well-known documents, we can always just register a well-known document to return the list such as:

http://example.com/.well-known/content

This has the advantage of being easier to deploy (returning a custom format for a GET on a directory might be challenging in many environments) and replace with better lists in the future (new well-known document).

EHL

> -----Original Message-----
> From: Mark Nottingham [mailto:[email-masked]]
> Sent: Tuesday, October 13, 2009 6:26 PM
> To: [email-masked]
> Cc: Eran Hammer-Lahav
> Subject: Fwd: Last Call: draft-nottingham-site-meta (Defining Well-

---

From: Barry Leiba <[email-masked]>
Date: Mon, 19 Oct 2009 21:11:55 -0400

> Do people find this interesting? To specify it, we'd just need to describe a
> format (e.g., a space-separated list of tokens).
>
>> Depending on how the server is configured a query to
>> http://example.com/.well-known/ might return the list of files in that
>> directory. It might be nice to actually encourage that. The only downside I
>> see is that it might make it easier for an attacker to find out what you run
>> and know what to exploit, but without that the attacker could still play 20
>> questions and find out.

I like it.  I understand Eran's issue, but I don't see the point in
waiting before making the specification.

Barry

---

From: "Thomson, Martin" <[email-masked]>
Date: Tue, 20 Oct 2009 10:16:13 +0800

This would be quite helpful - if a client modifies behaviour based on what it understands a server to "support", then this would facilitate detection of that support.

With respect to Eran's concerns, it's probably not necessary to roll the two concepts together.  A second document would let us resolve those concerns without affecting the immediate usefulness of the base well-known.

Along with that, is there any desire to attempt to register any examples in the registry?  Moving robots.txt and favicon.ico here seems logical.

> From: [email-masked] [mailto:apps-discuss-
> [email-masked]] On Behalf Of Barry Leiba
> Sent: Tuesday, 20 October 2009 12:12 PM
> To: Mark Nottingham
> Cc: [email-masked]
> Subject: Re: Last Call: draft-nottingham-site-meta (Defining Well-Known
> URIs) to Proposed Standard
> 
> describe a
> _______________________________________________
> Apps-Discuss mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/apps-discuss

---

From: Eran Hammer-Lahav <[email-masked]>
Date: Mon, 19 Oct 2009 20:53:01 -0700

> Sent: Monday, October 19, 2009 6:12 PM
> To: Mark Nottingham

You can go ahead and do it right now. I personally don't have any use case for it, and I don't think it will be very useful for a while. If anything, I am working on a proposal that will provide a generically useful document for more protocols under /.well-known. I just don't think there is compelling reason to use the directory itself as the way to get the list of documents (considering the deployment challenges).

EHL

---

From: Eran Hammer-Lahav <[email-masked]>
Date: Mon, 19 Oct 2009 20:56:34 -0700

> [email-masked]] On Behalf Of Thomson, Martin
> Sent: Monday, October 19, 2009 7:16 PM
> To: [email-masked]; Mark Nottingham
> Subject: RE: Last Call: draft-nottingham-site-meta (Defining Well-Known
> This would be quite helpful - if a client modifies behaviour based on
> what it understands a server to "support", then this would facilitate
> detection of that support.
> 
> With respect to Eran's concerns, it's probably not necessary to roll
> the two concepts together.  A second document would let us resolve
> those concerns without affecting the immediate usefulness of the base
> well-known.

I would be happy to help/edit such a separate proposal if people are willing to submit use cases. This can be very simple or very complex.

> Along with that, is there any desire to attempt to register any
> examples in the registry?  Moving robots.txt and favicon.ico here seems
> logical.

"Moving" them is wishful thinking at best. I can poke around at Google and Yahoo! to see if the search teams would even want to think about it but it would be nothing but dead records in the registry. And dead records tend to make the whole registry look bad.

I have just submitted (an incomplete) proposal for /.well-known/host-meta which will be published (hopefully) shortly after the registry is set up.

EHL

> > >> see is that it might make it easier for an attacker to find out
> what
> > you run
> > >> and know what to exploit, but without that the attacker could
> still
> > play 20
> > >> questions and find out.
> >

---

From: "Thomson, Martin" <[email-masked]>
Date: Tue, 20 Oct 2009 12:06:38 +0800

> "Moving" them is wishful thinking at best. I can poke around at Google
> and Yahoo! to see if the search teams would even want to think about it
> but it would be nothing but dead records in the registry. And dead
> records tend to make the whole registry look bad.

"moving" was intentionally inflammatory ;)  I'd imagine that these would need to remain in their current locations indefinitely.  However, I do mean "moving" in the sense that it seems that would be a desirable end goal.  Starting with a registration would be a start.

---

From: Barry Leiba <[email-masked]>
Date: Tue, 20 Oct 2009 00:51:28 -0400

> If anything, I am working on a proposal that will provide a generically
> useful document for more protocols under /.well-known. I just don't
> think there is compelling reason to use the directory itself as the way
> to get the list of documents (considering the deployment challenges).

Oh, it certainly doesn't have to use the directory itself.  The point
was to "query" the directory; that could be done by asking for, say,
"index.xml", or whatever.  What I like about Lorrie's idea is having a
mechanism to do the query.  I don't care what the mechanism is.

Barry