Subject: question on draft-hammer-hostmeta-08

From: Tim Williams <[email-masked]>
Date: Wed, 12 May 2010 08:08:10 -0400

Regarding the subject memo, can someone say why regular HTTP headers
aren't appropriate for this purpose?  I realize that the well-known
URI approach/compromise, might be necessary for the pragmatic purposes
of publishers not being able to control their outbound headers, but in
this case, host-meta applies to the whole host.  So I wonder why the
compromise is in order?  As opposed to, for example, using an HTTP
header with a link to a descriptive resource?

A few other questions that pop up:

o) Why is it necessary to prescribe a metadata format too - it seems
like the 'how to find it' is a different problem than 'how is it
represented'?  I mean, why couldn't I just document my host metadata
in HTML5 and use the same link relations described here (e.g. license,
author)?

o) Why can't the host be implied from the request?  Is there a case
where a metacard describing a host other than the one being contacted
be desirable?

Anyway, I'm following the comment instructions in the document, if
there's a better place for such elementary questions, please let me
know...

Thanks,
--tim

---

From: Eran Hammer-Lahav <[email-masked]>
Date: Wed, 12 May 2010 08:28:51 -0700

Hi Tim,

> -----Original Message-----
> From: [email-masked] [mailto:apps-discuss-
> [email-masked]] On Behalf Of Tim Williams
> Sent: Wednesday, May 12, 2010 5:08 AM
> To: [email-masked]
> Subject: question on draft-hammer-hostmeta-08
> 
> aren't appropriate for this purpose?  I realize that the well-known URI
> approach/compromise, might be necessary for the pragmatic purposes of
> publishers not being able to control their outbound headers, but in this case,
> host-meta applies to the whole host.  So I wonder why the compromise is in
> order?  As opposed to, for example, using an HTTP header with a link to a
> descriptive resource?

A link from where? Some protocols abuse the root resource and put a link there, but that is wrong because the link's subject isn't the root resource but something else - the host.

When Yahoo! implemented OpenID (which requires such link on http://yahoo.com/) the company decided that adding an extra header to all responses (when the number of clients actually interested in this header is miniscule) so they hacked it in: the header only shows up when you do a HEAD but not a GET, or when there is no user-agent header (meaning not a browser).

The reason we created Well-Known (and not just a single host-meta document which was the original proposal) was that it was clear that a single metadata document for all needs will never work. The same goes with this, which means, the root resource is going to end up with a whole bunch of such headers.

> o) Why is it necessary to prescribe a metadata format too - it seems like the
> 'how to find it' is a different problem than 'how is it represented'?  I mean,
> why couldn't I just document my host metadata in HTML5 and use the same
> link relations described here (e.g. license, author)?

Because that fails to achieve interop. It is one thing to offer a set of supported formats but no format makes the whole thing useless. You already have RFC 5785 - if the format of host-meta isn't suitable for your needs (you don't want to process XML or you need a more powerful schema like POWDER), feel free to define something else and request to register it.

There is currently a lot of interest in a JSON version of XRD which might end up as an extension to host-meta (for example, requesting host-meta.json will result in a JSON serialization of the same metadata).

> o) Why can't the host be implied from the request?  Is there a case where a
> metacard describing a host other than the one being contacted be desirable?

First, you have the example.com vs www.example.com case where most sites have an automatic redirect. This gets important when you perform trusted discovery - you need a way to make sure the document is about what you asked for (XRD offers digital signatures).

Second, using the well-known location is just one way to obtain the document. XRD documents are self-contained and state what they are describing using the <Subject> element. Because there is not such URI for host [1], host-meta defines an element just for that.
 
> Anyway, I'm following the comment instructions in the document, if there's a
> better place for such elementary questions, please let me know...

This is the right place.

EHL

[1] http://lists.oasis-open.org/archives/xri-comment/200911/msg00021.html