Re: [I18ndir] I18ndir early review of draft-ietf-dispatch-javascript-mjs-07

[John R Levine <[e-mail]>]

On Sat, 9 May 2020, Patrik Fältström wrote:
>> I'm sorry to hear that people are using filename extensions to tell what's in a file.  I'd hoped that all of the badness from old versions of Windows doing that might have been a hint.
>
> This is something that just must go away, and I think a big note in non-friendly letters must be added in the security considerations section is needed that explain the situation and why the current practice is not really what we want in the wild.
>
> I.e. yes, while still documenting "what works", that should not be the goal. It will lead to even more problems getting secure mechanisms in browsers deployed.

I agree with Patrik, this reinvents a security hole from the floppy disk 
era and is not something we should let pass without at least making it 
clear that we believe it is a significant mistake.

It occurs to me that http clients can send an Accept header, so how about 
saying that modules SHOULD be text/jsmodule, but MAY be text/javascript 
for backward compatibiltiy with clients that don't handle text/jsmodule?

Regards,
John Levine, [e-mail], Taughannock Networks, Trumansburg NY
Please consider the environment before reading this e-mail. https://jl.ly