Re: [apps-discuss] draft-ietf-weirds-bootstrap-00 and our lawn -- feedback?

[Nico Williams <[e-mail]>]

On Thu, Feb 13, 2014 at 8:25 AM, John R Levine <[e-mail]> wrote:
> My, I seem to have kicked a hornet's nest here.

Maybe.  Perhaps the get-off-my-lawn argument needs some fleshing out.
Clearly there are people who don't see how it follows from the stated
principles.

> The advice in the get off my lawn draft reads to me as "some web servers are
> amazingly lame, so web clients have to use templates to deal with it." I
> certainly believe the first part, but it is not obvious that the second part
> is always the correct response.

I don't share this impression.

>> Suppose my server comes with a package where I have to route endpoints
>> based on URL parameters, so the WEIRDS requests come in to
>> "https://example.com?service=weirds <https://example.com/?service=weirds>"
>> so that’s my registry value.
>
> Why wouldn't it be reasonable to say if you want to run RDAP, use a server
> that can support it?  We expect there to be vastly more RDAP clients than
> servers, so it seems perverse to push complexity into the clients.

I think the harm from specifying baked-in local parts of URIs is that
they might collide with other pre-existing and unrelated local parts
of URIs on the servers that might want to run RDAP some day.

I.e., if I run foo.example and RDAP would make me displace an existing
resource at foo.example, that'd be bad for me.

ISTM that what's needed here is a method for discovering where the
RDAP service is hosted on foo.example.  A well-known URI would seem
appropriate.  Note that any discovery method not based on DNS is going
to add round trips -- I don't know how important that is to RDAP, or
that HTTP is a good choice if latency matters a lot to RDAP anyways.

> With regard to Graham's question, I'd say RDAP is a service.  It defines the
> queries, and it defines the return codes and blobs of JSON that come back.
> If you are not a domain or IP registry, it's hard to think of a reason to
> run it.

Yeah, but if you own a domain you're probably running an HTTP service
and some apps on it, and RDAP is stepping on your lawn.  If this sets
a precedent that one should not run anything but "standard apps" in
some domainnames, then that'd be extra bad (and definitely counter to
current practice).  It'd be much better to not do this.

Nico
--