RE: Last Call: draft-nottingham-site-meta (Defining Well-Known URIs) to Proposed Standard

[Eran Hammer-Lahav <eran at hueniverse.com>]

I think it would be premature to define this before we have a few items in the registry and see how it is used. It doesn't offer significant value (today) other than a small optimization for protocols looking for multiple well-known documents.

But if we find the registry popular and new applications make use of multiple well-known documents, we can always just register a well-known document to return the list such as:

http://example.com/.well-known/content

This has the advantage of being easier to deploy (returning a custom format for a GET on a directory might be challenging in many environments) and replace with better lists in the future (new well-known document).

EHL

> -----Original Message-----
> From: Mark Nottingham [mailto:mnot at mnot.net]
> Sent: Tuesday, October 13, 2009 6:26 PM
> To: apps-discuss at ietf.org
> Cc: Eran Hammer-Lahav
> Subject: Fwd: Last Call: draft-nottingham-site-meta (Defining Well-
> Known URIs) to Proposed Standard
> 
> Forwarded with permission.
> 
> Do people find this interesting? To specify it, we'd just need to
> describe a format (e.g., a space-separated list of tokens).
> 
> Cheers,
> 
> 
> Begin forwarded message:
> 
> > From: Lorrie Faith Cranor <lorrie at cs.cmu.edu>
> > Date: 13 October 2009 12:03:24 AM AEDT
> > To: Mark Nottingham <mnot at mnot.net>
> > Subject: Re: Last Call: draft-nottingham-site-meta (Defining Well-
> > Known URIs) to Proposed Standard
> >
> > Hey Mark!
> >
> > I just saw this... wow an idea that's been kicking around a long
> > time since we introduced the well-known location in P3P. I'm not
> > involved in W3C stuff any more but lurk on some of these lists. It
> > occurs to me that if a lot of applications adopted this, it would be
> > useful to make one query to the .well-known directory to get a list
> > of all the files there so I don't have to play 20 questions with a
> > server to find out what it supports. Depending on how the server is
> > configured a query to http://example.com/.well-known/ might return
> > the list of files in that directory. It might be nice to actually
> > encourage that. The only downside I see is that it might make it
> > easier for an attacker to find out what you run and know what to
> > exploit, but without that the attacker could still play 20 questions
> > and find out.
> 
> 
> 
> --
> Mark Nottingham     http://www.mnot.net/