Re: [calsify] Barry Leiba's Discuss on draft-ietf-calext-eventpub-extensions-12: (with DISCUSS and COMMENT)

[Michael Douglass <[e-mail]>]

That would have been a good discussion to have. Somehow it dropped off 
the list.

I'd suggest it's not specifically a problem with this draft - we already 
have that issue with other properties and other drafts but I certainly 
don't mind using it as a starting point.

I think we need more than just a single paragraph: we do have this

Guidelines to protect against calendar abuse 
(https://standards.calconnect.org/csd/cc-18003.html)

It does refer to links as an issue but maybe we need more detail?

On 6/26/19 10:41, Barry Leiba wrote:
>>>> — Section 10 —
>>>> It’s good to refer to RFC 3986 for URI-related security considerations, and all
>>>> of them do apply here.
>>>>
>>>> Something else that comes to mind that comes along with a set of new URIs is
>>>> whether they actually point to what they say they do.  I don’t see that there’s
>>>> any way to verify that they do, and I’m very skeptical about the effectiveness
>>>> of warning an end user about this sort of thing, for many reasons.  I can see
>>>> why allowing URIs is convenient and compelling, but I’m very heavily concerned
>>>> about tracking and other privacy leaks, malicious and deceptive content, and
>>>> other such problems, especially considering the prevalence of abusive calendar
>>>> invitations these days.
>>>>
>>>> I’m not sure what the answer is here, but let’s have a discussion about it and
>>>> see where we can go with it.
>>> Maybe a brief discussion at CalConect/IETF meeting?
>> Yes, that sounds like a good idea.  We'll hold this until then.
> I see the notes from the meeting, and all I see about this document is:
>
>> Eventpub:
>> - https://datatracker.ietf.org/doc/draft-ietf-calext-eventpub-extensions/
>> - Discussion about the SOURCE property (drop it)
>> - Need to define “social calendaring”.
> Was the URI issue I raised discussed?  If not, when can we discuss it
> and clear this up?
>
> Barry