Re: [apps-discuss] Fwd: I-D Action: draft-nottingham-http-browser-hints-01.txt

[Dzonatas Sol <[e-mail]>]

On 05/30/2011 04:25 PM, Bjartur Thorlacius wrote:
>
> What queue? Most (but not all) HTTP methods operate on resources
> identified by URIs.
>    

We don't inline any of the http method calls, so they are all queued 
asynchronously. Programs, then, can easily examine the queue for 
optimizations, especially to stream them all together. That's the 
ReSTful queue. That's works well and simply quicker when there hundreds 
of queries between two end points.


>    
>> Any implication of an attacker... questionable on why would one stop
>> there, specifically, even if we assume "they're inside".
>>
>>      
> You don't necessarily have to be "inside" to be able to upload files.
> I'm thinking of a user registering as ".well-known" and uploading
> maliciously named and crafted files.

If someone is not logged in, for example, then one could issue one of 
the 3xx codes and possibly issue some private URL. I don't see the 
conflict there.

>   *All* HTTP servers out there will
> have to reserve the "/.well-known" prefix, if only to avoid serving a
> dangerous value of the max-conns property in the browser-hints file
> (and thereby values of other properties such as max-pipeline-depth).
>    

"have-to"?

The example uses the full path for simple conveyance, yet there could be 
</.well-known/> in container setups that implement RFC5785 and 
<draft-nottingham-http-browser-hints-01.txt/>, especially when 
restricted to no nested directories. If there is no </.well-known/> then 
most likely fallback to the "User-Agent:" header if that exists; 
otherwise, eventually assume some past http provider on one end.


> Note that I don't disagree with RFC 5785. It's the right mechanism for
> certain tasks. I disagree with the apparent group consensus that
> discovery of browser hints are one of these tasks.
>
>    

Do you think that information should exist in the "User-Agent:" header 
and have everybody upgrade their browser together as one group? Maybe 
some rather use 'cloud' containers with restricted data driven flow, but 
I can think of too many other examples, and the 'cloud' idea is actually 
useful for an example as one step beyond as site (i.e. containers) on 
demand despite paths based on URIs in individual queries and synchronous 
end-to-end flow.

-- 
--- https://twitter.com/Dzonatas_Sol ---
Web Development, Software Engineering, Virtual Reality, Consultant