Subject: [apps-discuss] Stephen Farrell's Yes on draft-ietf-appsawg-http-problem-02: (with COMMENT)

From: "Stephen Farrell" <[email-masked]>
Date: Fri, 11 Dec 2015 09:16:34 -0800

Stephen Farrell has entered the following ballot position for
draft-ietf-appsawg-http-problem-02: Yes

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-appsawg-http-problem/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

- 3.1: "SHOULD NOT automatically" de-ref the type URI. Hmm, under
what circumstances would it be reasonable for any code to
automatically de-ref the type URI? If none, then either
s/SHOULD/MUST/ or maybe s/automatically// 

- 3.1, last para: I'm sure this is a known thing, but I don't know
the answer, so I'll ask:-) If I send a request for URL
example.com/foo and am re-directed to example.net/bar, against which
of those is a relative URL in the problem detail evaluated?  I hope
the answer is example.net - if not, there could be some attack that
could be mounted but I've not got a concrete example to offer.

- 3.2, last para: should "media type" be "problem type" at the end?

- 4: "typically with the "http" scheme" - your examples are all
https, don't you mean https here too?

---

From: Mark Nottingham <[email-masked]>
Date: Fri, 18 Dec 2015 11:30:18 +1100

Hi Stephen,

I might write a linter that checks how problem types are used, and a companion format that gives it machine-readable information about them. In that use case, it makes sense to automatically dereference the problem type.

> could be mounted but I've not got a concrete example to offer.

A redirect is a separate request, so it establishes the base URI. See <http://tools.ietf.org/html/rfc3986#section-5.1>, especially 5.1.3.

> - 3.2, last para: should "media type" be "problem type" at the end?

No, we mean media type. If you want to introduce a new, non-problem-type-specific "standard" parameter (like those already defined), it needs to be signalled with a new media type.

> https, don't you mean https here too?

Changing to "http or https":
  https://github.com/mnot/I-D/commit/c082522cfb0

Cheers,

--
Mark Nottingham   https://www.mnot.net/

---

From: Stephen Farrell <[email-masked]>
Date: Fri, 18 Dec 2015 07:11:02 +0000

Fair enough - those all all good answers,
Ta,
S.