Subject: Fwd: New Version Notification for draft-nottingham-site-meta-03

From: Mark Nottingham <[email-masked]>
Date: Thu, 17 Sep 2009 16:59:26 +1000

See:
   http://www.ietf.org/id/draft-nottingham-site-meta-03.txt
and diff at:
   http://bit.ly/2WpmJI

Begin forwarded message:

> From: IETF I-D Submission Tool <[email-masked]>
> Date: 17 September 2009 4:56:29 PM AEST
> To: [email-masked]
> Cc: [email-masked]
> Subject: New Version Notification for draft-nottingham-site-meta-03
>
>
> A new version of I-D, draft-nottingham-site-meta-03.txt has been  
> successfuly submitted by Mark Nottingham and posted to the IETF  
> repository.
>
> Filename:	 draft-nottingham-site-meta
> Revision:	 03
> Title:		 Defining Well-Known URIs
> Creation_date:	 2009-09-17
> WG ID:		 Independent Submission
> Number_of_pages: 8
>
> Abstract:
> This memo defines a path prefix for "well-known locations" in URIs.
>
>
>
> The IETF Secretariat.
>
>

--
Mark Nottingham     http://www.mnot.net/

---

From: Bil Corry <[email-masked]>
Date: Thu, 17 Sep 2009 07:25:43 -0500

>From the above:

---8<---
A well-known URI is a URI [RFC3986] whose path component begins with
the characters "/.well-known/".
--->8---

I know for my own server, any file or directory within the path component that begins with a period or underscore returns 403.  That's to prevent serving .htaccess, .svn, .project, ._.DS_Store, __MACOSX, and other configuration-type files and directories -- leading periods and underscores seem to be popular for them.  I can add an exception for "/.well-known/", but wanted to mention it in case there were other alternatives being considered for the path component.

- Bil

---

From: Julian Reschke <[email-masked]>
Date: Thu, 17 Sep 2009 14:34:15 +0200

Bil Corry wrote:
> ...

I think that's actually a strong point *in favor* of using a leading dot 
(less chance for overlap with real-world URIs).

BR, Julian

---

From: Eran Hammer-Lahav <[email-masked]>
Date: Thu, 17 Sep 2009 08:57:30 -0700

Exactly.

The fact that it takes more steps to enable /.well-known/ is in line with our goal of using a non-obvious path that is usually not permitted as part of usernames in social networks and other sites.

But thanks for pointing this out as it will help us get more adoption by letting people know to check for such restrictions.

EHL

> -----Original Message-----
> From: [email-masked] [mailto:apps-discuss-
> [email-masked]] On Behalf Of Julian Reschke
> Sent: Thursday, September 17, 2009 5:34 AM
> To: Bil Corry
> Cc: Apps Discuss
> Subject: Re: Fwd: New Version Notification for draft-nottingham-site-
> meta-03
> 
> Bil Corry wrote:
> > I know for my own server, any file or directory within the path
> component that begins with a period or underscore returns 403.  That's
> to prevent serving .htaccess, .svn, .project, ._.DS_Store, __MACOSX,
> and other configuration-type files and directories -- leading periods
> and underscores seem to be popular for them.  I can add an exception
> for "/.well-known/", but wanted to mention it in case there were other
> alternatives being considered for the path component.
> > ...
> 
> _______________________________________________
> Apps-Discuss mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/apps-discuss

---

From: Bil Corry <[email-masked]>
Date: Thu, 24 Sep 2009 23:56:42 -0500

Hmm, apparently blocking on a leading dot isn't as widespread as I would have thought:

	http://www.techcrunch.com/2009/09/23/basic-flaw-reveals-source-code-to-3300-popular-websites/

FWIW, this is the Apache mod_rewrite rule I'm using to block requests that have path components that begin with a dot or underscore, yet it allows /.well-known/ requests:

	RewriteCond %{REQUEST_URI}  !^/.well-known/.*$
	RewriteRule (^|/)(_|\.).*$  - [L,NS,F]

- Bil

---

From: Breno de Medeiros <[email-masked]>
Date: Fri, 25 Sep 2009 08:59:01 -0700

Insecure sites are, well, insecure.

Adding the '.' prevents against attacks on sites that have taken some
measures to secure themselves.

-- 
--Breno

+1 (650) 214-1007 desk
+1 (408) 212-0135 (Grand Central)
MTV-41-3 : 383-A
PST (GMT-8) / PDT(GMT-7)