Re: [core] Trusting links in .well-known/core

[Klaus Hartke <[e-mail]>]

Carsten Bormann wrote:
> Well, there is a statement in there: “If you want to discover information about kadse, it may be of interest that kefer hosts that resource over there.”  Without additional context, that may be nonsensical, but with an RT, it might point to any kind of resource that is of interest in conjunction with knowing about the current server.

There is a difference between kadse.example saying e.g. "my billing
server is located at <coap://kefer.example/42/>" and "kefer.example
hosts a billing server at <coap://kefer.example/42/>".

> This is a nice example of a misuse of the word “trust”.  How do you “trust a link”? [...]
> Whether that has influence on what you do next depends on your authorization policies.

That sounds like a very good definition for "trust". You trust a link
if your authorization policies allow you to do something next.

> I can’t parse this sentence.  Links associate “contexts” (bad name for the source of a link) to target resources.  Section 2.1 only helps you find out what the “context” is (and I agree, it exhibits some weirdness).

RFC 8288 suggests that a client discards any link where the actual
link context is overridden. This is the case for every link in Link
Format. (Because if there is no anchor attribute that overrides it,
Section 2.1 overrides it with the "origin" of the link target.)


Klaus