Re: [I18ndir] I18ndir early review of draft-ietf-dispatch-javascript-mjs-07

[Patrik Fältström <[e-mail]>]

On 9 May 2020, at 1:31, John R Levine wrote:

> I completely agree that for something like this which is widely implemented, the spec should describe what actually works.  But I was wondering if you could narrow down the range of what you describe so future implementors don't waste time worrying about screwups that aren't an issue in practice.

It is also the case that the IETF document can explain exactly this, that the use of filename extensions is discouraged (for a multitude of reasons), and still define a new MIME-type which is the recommended use case. Collaboration with W3C is of course essential.

> I'm sorry to hear that people are using filename extensions to tell what's in a file.  I'd hoped that all of the badness from old versions of Windows doing that might have been a hint.

This is something that just must go away, and I think a big note in non-friendly letters must be added in the security considerations section is needed that explain the situation and why the current practice is not really what we want in the wild.

I.e. yes, while still documenting "what works", that should not be the goal. It will lead to even more problems getting secure mechanisms in browsers deployed.

   Patrik