Re: [art] Auto-configuring Email Clients via WebFinger

Steffen Nurpmeso <steffen@sdaoden.eu> Thu, 18 July 2019 19:06 UTC

Return-Path: <steffen@sdaoden.eu>
X-Original-To: art@ietfa.amsl.com
Delivered-To: art@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4C23D1205CC for <art@ietfa.amsl.com>; Thu, 18 Jul 2019 12:06:04 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.9
X-Spam-Level:
X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Tv7ZX8-bRQ37 for <art@ietfa.amsl.com>; Thu, 18 Jul 2019 12:06:02 -0700 (PDT)
Received: from sdaoden.eu (sdaoden.eu [217.144.132.164]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 17831120112 for <art@ietf.org>; Thu, 18 Jul 2019 12:06:02 -0700 (PDT)
Received: by sdaoden.eu (Postfix, from userid 1000) id 9928516057; Thu, 18 Jul 2019 21:06:00 +0200 (CEST)
Date: Thu, 18 Jul 2019 21:05:59 +0200
From: Steffen Nurpmeso <steffen@sdaoden.eu>
To: John Levine <johnl@taugh.com>
Cc: art@ietf.org
Message-ID: <20190718190559.kLTGt%steffen@sdaoden.eu>
In-Reply-To: <20190718051756.130D5510A29@ary.local>
References: <20190718051756.130D5510A29@ary.local>
Mail-Followup-To: "John Levine" <johnl@taugh.com>, art@ietf.org
User-Agent: s-nail v14.9.13-132-g2b425bda
OpenPGP: id=EE19E1C1F2F7054F8D3954D8308964B51883A0DD; url=https://ftp.sdaoden.eu/steffen.asc; preference=signencrypt
BlahBlahBlah: Any stupid boy can crush a beetle. But all the professors in the world can make no bugs.
Archived-At: <https://mailarchive.ietf.org/arch/msg/art/neS2A9bwaT__lFB6BsgWnFLOuys>
Subject: Re: [art] Auto-configuring Email Clients via WebFinger
X-BeenThere: art@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Applications and Real-Time Area Discussion <art.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/art>, <mailto:art-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/art/>
List-Post: <mailto:art@ietf.org>
List-Help: <mailto:art-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/art>, <mailto:art-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 18 Jul 2019 19:06:04 -0000

I did not want to be unfriendly by not responding to you!

John Levine wrote in <20190718051756.130D5510A29@ary.local>:
 |In article <20190717223114.cO5Om%steffen@sdaoden.eu> you write:
 |>|>> Plan A: if the server needs the user name and password, it sends back
 |>|>> a 401 response and the MUA sends them via RFC 7617 basic
 |>|>> authentication.  That seems largely backward compatible and invents a
 |>|>> minimum of new stuff.
 |>
 |>Just yesterday i (currently implementing OAUTHBEARER for a BSD
 |>Mail clone) thought how easy it would be if the OAUTHBEARER
 |>request would have additional fields, like refresh-token etc.
 |
 |I believe you, but as I may have said once or twice before, my
 |proposal is intended to be a compatible extension of the autoconfig
 |that the most popular open source MUA already has.

The pages which describe the feature seem to have been patched
together wildly over the years.  As they are now they do not put
confidence in what should really be done (to an extend).

 |>|One of the reasons Mozilla checks https://autoconfig.<domain>/ is \
 |>|exactly \
 |>|this:
 |>|it lets the mail department run a small special purpose web server \
 |>|separate from the main web servers.
 |>
 |>I will never understand where the benefit of turning mail clients
 |>into fully blown browsers actually is.
 |
 |I don't see how this follows.  In both of these proposals, the MUA makes
 |a few HTTP requests and then gets a blob of XML or JSON.  That skips \
 |the 95%
 |of browsers that render HTML.  (We'll ignore the detail that modern \
 |MUAs all
 |have that 95% anyway to render HTML mail.)

Ok, yes, simply talking a minimal set of HTTP in order to get
automatic configuration would really be easy to do; parsing the
answers could require an additional library, for the MUA
i maintain.  I personally would prefer seeing this in the DNS, but
since everything seems to move into .well-known, this is a target
as valid as everything else.

 |>Are you trying to enforce code reuse of anyway linked-in web kits,
 |>otherwise i do not know.
 |
 |No, I'm trying to make it backward compatible with existing MUAs.
 |
 |>In the end i will have to implement actions aka "clickable" URLs
 |>for a text-mode mail reader.
 |
 |I don't understand that at all.  Why would you need to do that?

You are of course right, this does not follow at all.
And, for one i definitely need to find a solution for such anyway;
and second the ConfigFileFormat Wiki indeed mentions form input
fields, except that this is declared "not yet supported" in an
accompanying comment.  (But the latter could simply be prompts in
a console based UI, of course.)

--steffen
|
|Der Kragenbaer,                The moon bear,
|der holt sich munter           he cheerfully and one by one
|einen nach dem anderen runter  wa.ks himself off
|(By Robert Gernhardt)