[httpapi] [IANA #1387836] expert review for draft-ietf-httpapi-api-catalog (link-relations)

[David Dong via RT <[e-mail]>]

Hi Mark, all,

Following up on this; please see Kevin's response below and on the httpapi list; thank you.

Best regards,

David Dong
IANA Services Sr. Specialist

On Wed Dec 11 01:06:12 2024, david.dong wrote:
> Hi Mark, all,
> 
> Please see Kevin's response below and on the httpapi list; thank you.
> 
> Best regards,
> 
> David Dong
> IANA Services Sr. Specialist
> 
> On Thu Dec 05 09:28:51 2024, [e-mail] wrote:
> > Dear Amanda, all,
> > 
> > 
> > 
> > Many thanks for raising the issue, I responded on the httpapi list at
> > [1] as follows:
> > 
> > 
> > --
> > HI Amanda, Mark,
> > 
> > 
> > 
> > > In version -06, the registration's "description" field has been
> > 
> > > updated to change "context" to "target domain" (see Section 7.2):
> > 
> > >
> > 
> > > https://datatracker.ietf.org/doc/html/draft-ietf-httpapi-api-catalog
> > 
> > 
> > 
> > Thanks for catching this, it was my mistake - in attempting to resolve
> > a previous comment for draft-05 [2], which had correctly challenged my
> > use of the unclear phrase 'owner of the link context', I mistakenly
> > removed 'context' as well from the description field.
> > 
> > 
> > 
> > As Herbert pointed out (thanks!), Section 3 has the wording I
> > intended. So in draft-07 I propose to change the description in 7.2
> > to:
> > 
> > 
> > 
> > "Description: The link target identifies a resource that represents a
> > list of APIs available from the Publisher of the context resource."
> > 
> > 
> > 
> > All best,
> > 
> > 
> > 
> > Kevin
> > --
> > 
> > [1]
> > https://mailarchive.ietf.org/arch/msg/httpapi/w8VtmpTdXLah8lfyGKkOzptOOLo/
> > 
> > [2] https://github.com/ietf-wg-httpapi/api-catalog/issues/18
> > 
> > 
> > 
> > -----Original Message-----
> > From: Amanda Baber via RT <[e-mail]>
> > Sent: 04 December 2024 19:01
> > Cc: [e-mail]
> > Subject: [IANA #1387836] expert review for draft-ietf-httpapi-api-
> > catalog (link-relations)
> > 
> > 
> > 
> > This email originated from outside of the organisation: Verify the
> > sender and content before clicking or downloading. Report this email
> > using Report Message button if unsure.
> > 
> > 
> > 
> > Dear Authors,
> > 
> > 
> > 
> > Please see the message Mark Nottingham (one of three link relations
> > experts) sent to the httpapi list yesterday. I've marked the document
> > "IANA NOT OK."
> > 
> > 
> > 
> > thanks,
> > 
> > Amanda
> > 
> > 
> > 
> > On Wed Dec 04 04:33:30 2024, [e-mail]<mailto:[e-mail]>
> > wrote:
> > 
> > > Hi,
> > 
> > >
> > 
> > > > On 4 Dec 2024, at 6:03 AM, Amanda Baber via RT
> > 
> > > > <drafts-expert-review- [e-mail]<mailto:[e-mail]>>
> > > > wrote:
> > 
> > > >
> > 
> > > >> In version -06, the registration's "description" field has been
> > 
> > > >> updated to change "context" to "target domain" (see Section 7.2):
> > 
> > >
> > 
> > > This seems problematic, in that it allows any link on the Internet to
> > 
> > > assert an API catalogue for a given URI. At the very least some
> > 
> > > security considerations about consuming such an assertion should be
> > 
> > > outlined.
> > 
> > >
> > 
> > > Furthermore, it's a deviation from the Web Linking specification,
> > 
> > > which defines a link as involving a context, a target, and a relation
> > 
> > > type. The relation type definition can't modify this relationship. As
> > 
> > > such I suspect that this specification isn't defining a link relation
> > 
> > > per se, it's defining _something else_.
> > 
> > >
> > 
> > > Cheers,
> > 
> > >
> > 
> > >
> > 
> > > --
> > 
> > > Mark Nottingham
> > 
> > 
> > 
> > 
> > C2 General