Subject: [Wpack] https://tools.ietf.org/html/draft-thomson-wpack-content-origin-00

From: Ted Hardie <[email-masked]>
Date: Mon, 23 Mar 2020 08:54:19 -0700

Howdy,

Reading Sean's note about the agenda, I wondered if Martin's proposal had a
draft--turns out it does,
https://tools.ietf.org/html/draft-thomson-wpack-content-origin-00.  If that
got sent to this list, I somehow missed it.

I'm doing a quick review now, and there is much to dig into.  But I think
it's important to start with one point Martin makes early on:

   The web relies on the concept of origins [ORIGIN
<https://tools.ietf.org/html/draft-thomson-wpack-content-origin-00#ref-ORIGIN>]
as the primary
   means of identification for resources.  A strongly authenticated
   HTTPS origin is the basis for many security decisions.  However,
   establishing this identity relies on having an active TLS [TLS
<https://tools.ietf.org/html/draft-thomson-wpack-content-origin-00#ref-TLS>]
   connection to a server that is considered authoritative for the
   origin; see Section 11 of [HTTP
<https://tools.ietf.org/html/draft-thomson-wpack-content-origin-00#ref-HTTP>].

As RFC 6454 points out, the Origin concept is focused on scope of authority
and privilege, primarily in the context of the same-origin policy.  The
Web's view of *identification of resources*, rather than privilege, is
considerably more complex.  If you go back to the Dublin Core work
described in RFC 2413 (and its many successors1), you'll see that the idea
of resource identifiers associated with web retrieval and indexing goes
back a long way.  Some of those ideas, like the inclusion of URNs in
metadata tags so that you could identify a resource independently from
where it was received, were tried out during experiments in content
distribution as long ago as 1995. NASA's web indexers (based on the Harvest
system) did that, for example.2

I make this point not to dwell on the past but to call out that this
working group has to be very careful to distinguish between the ideas of
scope of privilege and other aspects of resource identification and
attribution.  Methods for resource identification outside of association
with the channel of retrieval are not new, and some sense of that context,
especially the drawbacks of previous systems, is probably useful.

regards,

Ted

1) Dublin core is now maintained by DCMI (
https://dublincore.org/specifications/dublin-core/)
2)  CIP and friends (RFC 2651 and 2655) emerged out of that set of
experiments and exchanges.