Re: [core] Disclosing Implementation Information: draft-bormann-t2trg-rel-impl-01.txt

Carsten Bormann <> Sun, 29 March 2020 12:47 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id E7BB83A07CC for <>; Sun, 29 Mar 2020 05:47:54 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: 0.001
X-Spam-Status: No, score=0.001 tagged_above=-999 required=5 tests=[SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id x-EFAxUvgPK4 for <>; Sun, 29 Mar 2020 05:47:53 -0700 (PDT)
Received: from ( []) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPS id CE5713A079A for <>; Sun, 29 Mar 2020 05:47:52 -0700 (PDT)
Received: from [] ( []) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPSA id 48qwNg1sQ3zyRf; Sun, 29 Mar 2020 14:47:47 +0200 (CEST)
Content-Type: text/plain; charset="utf-8"
Mime-Version: 1.0 (Mac OS X Mail 13.0 \(3608.\))
From: Carsten Bormann <>
In-Reply-To: <>
Date: Sun, 29 Mar 2020 14:47:46 +0200
Cc: "" <>, " WG" <>
X-Mao-Original-Outgoing-Id: 607178866.7292809-40e68d1897cc197107280e0c91218aac
Content-Transfer-Encoding: quoted-printable
Message-Id: <>
References: <> <> <>
To: Klaus Hartke <>
X-Mailer: Apple Mail (2.3608.
Archived-At: <>
Subject: Re: [core] Disclosing Implementation Information: draft-bormann-t2trg-rel-impl-01.txt
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "Constrained RESTful Environments \(CoRE\) Working Group list" <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Sun, 29 Mar 2020 12:47:55 -0000

On 2020-03-29, at 14:08, Klaus Hartke <> wrote:
> Would it make sense to standardize how to exactly express the information about the implementation and version? Being able to find that information seems useful -- but incomplete :-)

If we want to encourage clients changing their behavior based on what they find, as in your example below: Yes.
If not:
The resource at the other end of the link has a media type.

We could still go ahead and define one or more media types for this.
I’m just not sure that we’ll find more commonality than text/plain or text/html here.
(We could find ourselves in security.txt land, though [1].  Hmm.)

> And then I'm wondering if there's a risk that we might end up with something like this in the future:
> 1. Client makes a GET request on the implementation information resource
> 2. Server returns a string like "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36"
> 3. Client behaves differently based on the implementation information

Any way of standardizing self-describing information increases this risk of sniffing against that.
Implementations might react on impl-info or on the mere fact that the temperature sensor resource is called “/temp” and not “/t”...

Grüße, Carsten