Subject: Re: RFC 2538bis security problem with the indirect types

From: "Stuart E. Schechter" <[email-masked]>
Date: Wed, 01 Feb 2006 10:09:08 -0500

> From: Simon Josefsson <[email-masked]>
... 
> I do agree that standardizing URI schemes to embed a hash of the
> content would be useful.

   I believe this has been proposed before, but hasn't happened because you
can't use hashes in URIs in any environment with circular references.
(e.g., web pages that link to each other.)

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Simon Josefsson <[email-masked]>
Date: Wed, 01 Feb 2006 16:30:50 +0100

> (e.g., web pages that link to each other.)

Right, the idea is not appropriate for all applications.  Still, it
may be useful to use when the target is an OpenPGP key.

However, in this case, it seems more appropriate to modify the CERT I*
types, to add a potentially optional field for a hash value.

Thanks.

---

From: "william(at)elan.net" <[email-masked]>
Date: Wed, 1 Feb 2006 07:36:22 -0800 (PST)

On Wed, 1 Feb 2006, Stuart E. Schechter wrote:

>   I believe this has been proposed before, but hasn't happened because 
> you can't use hashes in URIs in any environment with circular references.

I doubt it is main reason it did not happen. The bigger reason is that
those who are being referenced want easy way to keep track as to who
is referencing them, so that in case of changes the url with hash could
also be updated. So until we have standardized trackback notification
with authorization, URL with hash is useful only for certain specific 
environments.

-- 
William Leibzon
Elan Networks
[email-masked]