Subject: FW: New Version Notification for draft-hammer-hostmeta-10

From: Eran Hammer-Lahav <[email-masked]>
Date: Tue, 25 May 2010 12:35:20 -0700

After recent discussions at IIW about use cases for both host-meta [1] and LRDD [2], I came to the conclusion that there is little value in the multi-link-sources approach (collecting links from host-meta, HTTP headers, and HTML elements). Since the latest LRDD draft requires obtaining host-meta as the first step anyway, it significantly reduces the value of using links elsewhere (for this purpose).

The new host-meta draft incorporates the host-meta parts of LRDD, including the registration of the 'lrdd' relation type. My intention is to abandon the LRDD proposal and focus only on host-meta. Those using only host-meta are unaffected by this change.

Feedback on the latest host-meta draft is requested.

EHL

[1] http://tools.ietf.org/html/draft-hammer-hostmeta
[2] http://tools.ietf.org/html/draft-hammer-discovery

-----Original Message-----
From: IETF I-D Submission Tool [mailto:[email-masked]] 
Sent: Tuesday, May 25, 2010 12:25 PM
To: Eran Hammer-Lahav
Subject: New Version Notification for draft-hammer-hostmeta-10 

A new version of I-D, draft-hammer-hostmeta-10.txt has been successfully submitted by Eran Hammer-Lahav and posted to the IETF repository.

Filename:	 draft-hammer-hostmeta
Revision:	 10
Title:		 Web Host Metadata
Creation_date:	 2010-05-25
WG ID:		 Independent Submission
Number_of_pages: 15

Abstract:
This memo describes a method for locating host metadata as well as information about individual resources controlled by the host.

The IETF Secretariat.

---

From: John Panzer <[email-masked]>
Date: Tue, 25 May 2010 13:25:16 -0700

(As you know) like this approach much better, primarily because it reduces
the complexity of implementation down to what we've already coded up for
Webfinger, but allows non-acct: URIs as well.  Thus Webfinger is just acct:
+ host-meta, done.

Compared to the prior LRDD spec, this doesn't increase the number of
required HTTP requests, actually reduces them in some cases (http URLs that
would also require resolution at the resource level), and probably improves
interop due to simplicity.

NB: The one drawback is that resource owners who do not control
/.well-known/host-meta are dependent on their hosting provider to implement
LRDD links.  This drawback is also a security feature, and hosting providers
even with the prior spec were able to block per-resource LRDD if they wanted
to.  Note that this does not lock out individuals from implementing this
themselves at all; at worst, they just need to control their own domain name
and be able to copy /.well-known/host-meta to their host.  This is a tiny
speedbump, at last glance could be had for ~$30 per person, and I think is
well worth the security and simplicity trade-offs.

On Tue, May 25, 2010 at 12:35 PM, Eran Hammer-Lahav <[email-masked]>wrote:

> After recent discussions at IIW about use cases for both host-meta [1] and
> LRDD [2], I came to the conclusion that there is little value in the
> multi-link-sources approach (collecting links from host-meta, HTTP headers,
> and HTML elements). Since the latest LRDD draft requires obtaining host-meta
> as the first step anyway, it significantly reduces the value of using links
> elsewhere (for this purpose).
>
> The new host-meta draft incorporates the host-meta parts of LRDD, including
> the registration of the 'lrdd' relation type. My intention is to abandon the
> LRDD proposal and focus only on host-meta. Those using only host-meta are
> unaffected by this change.
>
> A new version of I-D, draft-hammer-hostmeta-10.txt has been successfully
> submitted by Eran Hammer-Lahav and posted to the IETF repository.
>
> This memo describes a method for locating host metadata as well as
> information about individual resources controlled by the host.
>
>
>
> The IETF Secretariat.
>
>
> _______________________________________________
> Apps-Discuss mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/apps-discuss
>

---

From: Bob Wyman <[email-masked]>
Date: Tue, 25 May 2010 16:31:35 -0400

John Panzer <[email-masked]> wrote:
> resource owners who do not control
> /.well-known/host-meta are dependent
> on their hosting provider

This problem may be more wide-spread than folk may think. I'm rather miffed,
for instance, that since *my* blog in on TypePad and since years ago I
enabled the "multi-blog" support option, there is simply no way that I can
put a .well-known file in a useful location on Typepad...

bob wyman

On Tue, May 25, 2010 at 4:25 PM, John Panzer <[email-masked]> wrote:

>> The new host-meta draft incorporates the host-meta parts of LRDD,
>> including the registration of the 'lrdd' relation type. My intention is to
>> abandon the LRDD proposal and focus only on host-meta. Those using only
>> host-meta are unaffected by this change.
>>

---

From: Eran Hammer-Lahav <[email-masked]>
Date: Tue, 25 May 2010 13:33:34 -0700

Sounds like something you should bring up with Typepad. The ability of users to hack their blogging platform seems like a bad thing to enable.

EHL

From: [email-masked] [mailto:[email-masked]] On Behalf Of Bob Wyman
Sent: Tuesday, May 25, 2010 1:32 PM
To: John Panzer
Cc: Eran Hammer-Lahav; Apps Discuss ([email-masked])
Subject: Re: FW: New Version Notification for draft-hammer-hostmeta-10

> on their hosting provider
This problem may be more wide-spread than folk may think. I'm rather miffed, for instance, that since my blog in on TypePad and since years ago I enabled the "multi-blog" support option, there is simply no way that I can put a .well-known file in a useful location on Typepad...

bob wyman

On Tue, May 25, 2010 at 4:25 PM, John Panzer <[email-masked]<mailto:[email-masked]>> wrote:
(As you know) like this approach much better, primarily because it reduces the complexity of implementation down to what we've already coded up for Webfinger, but allows non-acct: URIs as well.  Thus Webfinger is just acct: + host-meta, done.

Compared to the prior LRDD spec, this doesn't increase the number of required HTTP requests, actually reduces them in some cases (http URLs that would also require resolution at the resource level), and probably improves interop due to simplicity.

NB: The one drawback is that resource owners who do not control /.well-known/host-meta are dependent on their hosting provider to implement LRDD links.  This drawback is also a security feature, and hosting providers even with the prior spec were able to block per-resource LRDD if they wanted to.  Note that this does not lock out individuals from implementing this themselves at all; at worst, they just need to control their own domain name and be able to copy /.well-known/host-meta to their host.  This is a tiny speedbump, at last glance could be had for ~$30 per person, and I think is well worth the security and simplicity trade-offs.

On Tue, May 25, 2010 at 12:35 PM, Eran Hammer-Lahav <[email-masked]<mailto:[email-masked]>> wrote:
After recent discussions at IIW about use cases for both host-meta [1] and LRDD [2], I came to the conclusion that there is little value in the multi-link-sources approach (collecting links from host-meta, HTTP headers, and HTML elements). Since the latest LRDD draft requires obtaining host-meta as the first step anyway, it significantly reduces the value of using links elsewhere (for this purpose).

EHL

-----Original Message-----
From: IETF I-D Submission Tool [mailto:[email-masked]<mailto:[email-masked]>]
Sent: Tuesday, May 25, 2010 12:25 PM
To: Eran Hammer-Lahav
Subject: New Version Notification for draft-hammer-hostmeta-10

Abstract:

The IETF Secretariat.

_______________________________________________
Apps-Discuss mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/apps-discuss

_______________________________________________
Apps-Discuss mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/apps-discuss

---

From: John Panzer <[email-masked]>
Date: Tue, 25 May 2010 15:28:45 -0700

This sounds like a quality of implementation issue, which is best brought up
with Typepad.

Note that if Typepad implements host-meta itself, things will Just Work.  If
Typepad decides not to implement host-meta, but also gives you no way to add
your own /.well-known/host-meta on your own domain... well that's up to
them, they're not forced to offer you a choice.

Note: It's perfectly possible for specific protocols -- OpenID, say -- to
say that in _addition_ to host-meta, you should also check for specific link
tags or whatever else is desired.  Since this would be for a specific
protocol it can spec whether you check these first or last (what priority
they should get) fairly easily.  But this would be outside of the host-meta
spec itself.

On Tue, May 25, 2010 at 1:33 PM, Eran Hammer-Lahav <[email-masked]>wrote:

> Sounds like something you should bring up with Typepad. The ability of
> users to hack their blogging platform seems like a bad thing to enable.
>
>
>
> EHL
>
>
>
>
>
> *From:* [email-masked] [mailto:[email-masked]] *On Behalf Of *Bob
> Wyman
> *Sent:* Tuesday, May 25, 2010 1:32 PM
> *To:* John Panzer
> *Cc:* Eran Hammer-Lahav; Apps Discuss ([email-masked])
> *Subject:* Re: FW: New Version Notification for draft-hammer-hostmeta-10
>
>
>
> This problem may be more wide-spread than folk may think. I'm rather
> miffed, for instance, that since *my* blog in on TypePad and since years
> ago I enabled the "multi-blog" support option, there is simply no way that I
> can put a .well-known file in a useful location on Typepad...
>
>
>
> bob wyman
>
>
>
>
>