Re: [I18ndir] I18ndir early review of draft-ietf-dispatch-javascript-mjs-07

[Bradley Farias <[e-mail]>]

Forgive me, but the tone appears to be rather harsh against people who have
spent quite a few years waiting on this document to even get to a
visibility that we can discuss things. Per Adam Roach's recommendation we
did not go through a WG when I made this document years ago. The past few
emails seem rather derisive against such decisions, but I am still new to
IETF workings and would love help through the process; there seems to be
issues that cause me some personal confusion on the intent of a review.

Is there a way we can follow or be aided such that we can reach the "higher
bar" that we are unaware we were missing here such that we can go for a
normative change? I'm unclear but it seems like there is a desire to design
some solution for concerns about ECMA262 in host environments but I'm
unclear on this being the venue to do so and would be appreciative of
guidance on how to proceed.

Additionally, I have concerns with shipping things like MIMEs that are not
supported in any environment and are not discussed in the host venues they
intend to be used in and without any buy in from a host. This document is
trying to be normative to match the environment scenarios of not just
browsers but other environments that run ECMAScript such as server side
environments like Node.js are using text/javascript as the preferred
non-obsoleted form in order to coalesce around a standard that matches the
browser recommendations. The reversal of the application/javascript as the
preferred MIME was intentionally discussed in those environments. I'm
unclear on how creation of a new MIME would help here given we cannot
remove support for the status quo; creation of a new MIME seems like it
would require implementer interest to be a viable replacement.

Per things like hash bang comments and concerns about the language being
different from when older RFCs existed; I would view this document as being
a way to catch up to at least the status quo; creation of
unrelated evolution of standards paths that are not intended to match the
status quo likely won't be useful without other standards groups buy in. In
the future I'm sure people with such varied interests in the evolution of
ECMAScript certainly could participate in the evolution of the language if
they want to, but that was not the intent of this document. It seems like
an additional RFC might be desirable for other issues we are seeing brought
up here? Once again, I'm less familiar with IETF process and am unclear if
all possible design decisions need to be made in this document.

On Mon, May 11, 2020 at 2:16 PM John C Klensin <[e-mail]> wrote:

>
>
> --On Monday, May 11, 2020 12:55 -0400 John R Levine
> <[e-mail]> wrote:
>
> >> At this point, I'm afraid the ship has sailed. Introducing
> >> yet another MIME type *now* is unlikely to gain adoption in
> >> the HTML Standard, browsers, or on the web (because it
> >> wouldn't be backwards compatible). Let's not publish
> >> specs that intentionally conflict with both the HTML Standard
> >> and web reality.
> >
> > It actually would be backward compatible because of the advice
> > to use Accept media types to tell when to send which media
> > type, but if browsers aren't going to do it, I guess we put a
> > warning in the security section and give up.
>
> Well, just a minute.  Despite approval by DISPATCH for further
> discussion and processing, this is basically an individual
> submission, not a draft developed by a WG.  With the
> understanding that what I'm about to say is not I18n-specific
> and therefore should perhaps go on the agenda of the next
> DISPATCH meeting or wait for IETF Last Call, the IETF has, as
> Patrik has pointed out, both a collection of standards-track and
> BCP specifications in these areas and experience with what
> happens when other approaches (like reliance on name suffixes)
> are used instead.  Recommending something else is not just a
> matter of Security Considerations and, fwiw, I note that at
> least one document has been stuck after IETF Last Call completed
> in September because the IESG had DISCUSS-level concerns about
> telling implementers what they should do if they chose to not
> conform to the IETF's normative recommendations.   If this is
> really just a description of what browser vendors are doing or
> will do now and in the future, then we have a long history of
> publishing "for the information of the community, this is what
> some vendor or cluster of vendors are doing" descriptive
> Informational documents.  They are not standards track, they do
> not use normative language (2119/8174 terminology included),
> they just describe what is being done and are quite explicit
> about that.
>
> So, if the decision criteria for what belongs in this I-D is
> "whatever the browser vendors are going to do whether the IETF
> thinks it is a good idea or not", then let's see it recast as a
> "what is being done in practice" description, with the normative
> language removed or transformed into "if you want to do what the
> vendors are doing, then this is what you need to do" (or even
> "should" do - noting lower case).  If that means updating the
> registration for text/javascript (which, I note, is in the
> registry at
> https://www.iana.org/assignments/media-types/media-types.xhtml#text
> as "OBSOLETED in favor of application/javascript" -- exactly the
> opposite of which this I-D proposes) and application/javascript
> to treat them as vendor registrations (applying the exception
> for non-faceted names allowed by Appendix A of RFC 6838) then so
> be it... because that is, apparently, the truth of the matter.
>
> Sorry, but it seems to me that this document is trying to have
> it both (or all three) ways: to be a normative document without
> meeting the higher bar the IETF usually applies for standards
> track documents, to be a vendor specification without making
> that clear in the text (and noting that vendor specifications
> are still expected to have accurate Security Considerations
> sections), and to make requirements that are at variances with
> significant community experience about bad results when similar
> things have been done in only slightly different areas and still
> expect IETF consensus for the document.  I don't think that
> works.  YMMD.
>
> And...
>
> >> It's not entirely harmless. The following JS program
> >> behaves differently if it's preceded by a BOM:
> >>
> >> # !/usr/bin/env bash
> >
> > I really don't want to know when self-running shell scripts
> > became part of Ecmascript.
>
> Presumably, by an extension of the comments that caused the rant
> above, whatever "part of ECMAscript" means, they are a
> consideration because some or all browser vendors decided to
> treat them as if they were.
>
>     john
>
>