Re: [core] Tossing around URIs to use outside an application

[Klaus Hartke <[e-mail]>]

Christian Amsüss wrote:
> A thing that came up in last week's interim is the usability of URIs
> that you are just "tossed", with respect to secure usage.

In addition to secure usage, this came also up with respect to the
vocabularies used e.g. in CoRAL documents. I.e., if we need to pass
more than just a URI, such as security-related information, could we
also pass vocabulary-related information in the same way?

> What I'm leaning towards taking from this is that we should be able to
> support tossable URIs, but what they would look like in practice in a
> CoREnvironment may need looking into.

That might be closely related to the question what a tossable URI in a
CoREnvironment is precisely... When a Web browser is tossed a URI,
it's preconfigured with a set of root certificates and a single
purpose: Make a GET request to that URI and render the resulting HTML
document. In a CoREnvironment, there are probably no root certificates
and no predefined purpose. At a minimum, you probably always toss a
URI together with something like "Your resource directory is at this
URI" or "Please POST your sensor data to this URI". Additionally, you
probably also need to configure some certificate/PSK and the
intents/wills of the stakeholders/principals involved. Maybe some of
that needs to be set directly, maybe some could be discovered through
a layer of indirection. Is there something we could standardize here?

Klaus