Re: [calsify] Barry Leiba's Discuss on draft-ietf-calext-eventpub-extensions-12: (with DISCUSS and COMMENT)

[Michael Douglass <[e-mail]>]

On 6/26/19 10:41, Barry Leiba wrote:
>>>> — Section 10 —
>>>> It’s good to refer to RFC 3986 for URI-related security considerations, and all
>>>> of them do apply here.
>>>>
>>>> Something else that comes to mind that comes along with a set of new URIs is
>>>> whether they actually point to what they say they do.  I don’t see that there’s
>>>> any way to verify that they do, and I’m very skeptical about the effectiveness
>>>> of warning an end user about this sort of thing, for many reasons.  I can see
>>>> why allowing URIs is convenient and compelling, but I’m very heavily concerned
>>>> about tracking and other privacy leaks, malicious and deceptive content, and
>>>> other such problems, especially considering the prevalence of abusive calendar
>>>> invitations these days.
>>>>
>>>> I’m not sure what the answer is here, but let’s have a discussion about it and
>>>> see where we can go with it.

I'm not sure where to go with this one but I'd like to suggest it's not 
specific to the eventpub extensions spec.

I certainly agree there are a number of privacy and security concerns we 
should highlight but I'd rather see that done as a separate document 
which we can refer to in future. I think it's fair to say that the issue 
of tracking or following bogus URIs is not specific to this draft or to 
calendars in general. There are http headers, links in content etc etc.

I do think it's probably a good time to come up with at least a best 
practices document. There's also the privacy by design work going on in 
the ISO to which we can and probably should provide some input.

Unless we come up with such a document we have no choice but to re-raise 
the concerns every time a new spec comes out.

I do have some privacy issues I'd like to see covered - e.g. attendee or 
recipient information can be used to infer relationships between people 
(sometimes incorrectly).

We do have another CalConnect/IETF call coming up. Perhaps we can spend 
a bit if time on th etopic then (as we manged to not do so last time)


>>> Maybe a brief discussion at CalConect/IETF meeting?
>> Yes, that sounds like a good idea.  We'll hold this until then.
> I see the notes from the meeting, and all I see about this document is:
>
>> Eventpub:
>> - https://datatracker.ietf.org/doc/draft-ietf-calext-eventpub-extensions/
>> - Discussion about the SOURCE property (drop it)
>> - Need to define “social calendaring”.
> Was the URI issue I raised discussed?  If not, when can we discuss it
> and clear this up?
>
> Barry