Re: [core] Disclosing Implementation Information: draft-bormann-t2trg-rel-impl-01.txt

[Carsten Bormann <[e-mail]>]

On 2020-03-29, at 14:08, Klaus Hartke <[e-mail]> wrote:
> 
> Would it make sense to standardize how to exactly express the information about the implementation and version? Being able to find that information seems useful -- but incomplete :-)

If we want to encourage clients changing their behavior based on what they find, as in your example below: Yes.
If not:
The resource at the other end of the link has a media type.

We could still go ahead and define one or more media types for this.
I’m just not sure that we’ll find more commonality than text/plain or text/html here.
(We could find ourselves in security.txt land, though [1].  Hmm.)

> And then I'm wondering if there's a risk that we might end up with something like this in the future:
> 
> 1. Client makes a GET request on the implementation information resource
> 2. Server returns a string like "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36"
> 3. Client behaves differently based on the implementation information

Any way of standardizing self-describing information increases this risk of sniffing against that.
Implementations might react on impl-info or on the mere fact that the temperature sensor resource is called “/temp” and not “/t”...

Grüße, Carsten

[1]: https://securitytxt.org/