Re: [Id-event] Thread: Clarifying use of sub and iss in SET tokens

[Benjamin Kaduk <[e-mail]>]

I had to think a bit about why this didn't feel quite right to me.  I
think it's that I wasn't sure how the event consumer would know that the
(event) issuer is such an authoritative IdP.  Looking later in the
thread, it sounds like maybe the profile specification will make that
clear; is that the case?

Thanks,

Ben

On 03/09/2017 12:49 PM, Mike Jones wrote:
>
> One use case for which there is only a single issuer and a single
> subject is common and straightforward.  One example is when an
> Identity Provider is authoritative for a digital identity that it is
> the issuer for.  That IdP can issue events about that digital
> identity.  I’ll note that OpenID Connect uses are of this kind, and
> that the “sub” value is relative to the issuer – not globally unique. 
> Trying to make “sub” globally unique would be a breaking change.
>
>  
>
>                                                        -- Mike
>
>  
>
> *From:*Benjamin Kaduk [mailto:[e-mail]]
> *Sent:* Wednesday, March 8, 2017 3:47 PM
> *To:* Phil Hunt <[e-mail]>; Mike Jones
> <[e-mail]>
> *Cc:* ID Events Mailing List <[e-mail]>
> *Subject:* Re: [Id-event] Thread: Clarifying use of sub and iss in SET
> tokens
>
>  
>
> Sorry for the delay.
>
> On 03/07/2017 12:20 PM, Phil Hunt wrote:
>
>     Thanks Mike,
>
>      
>
>     Just to be clear. You are expressing a perspective of maintaining
>     the exact format as defined by the ID Token and imposing the limit
>     on all other Events.  
>
>      
>
>     If I understand correctly, JWT (RFC7519) has no such limitation on
>     sub and the group *could* choose to profile “sub” to be globally
>     unique for all SET Events. Correct?
>
>      
>
>     What I was trying to do was point out the 3 separate subject
>     identification formats already in the spec and to ask, is this
>     really acceptable (per Yaron’s request)?
>
>      
>
>     You and William have indicated a preference to leave it. 
>
>      
>
>     Justin and Benjamin did apparently express some concerns. Can they
>     clarify?
>
>      
>
>
> My preference would be your "4th option" to always have "sub" and
> "iss" in the events payload, even if "iss" is the same in the outer
> envelope and the events payload -- it's unambiguous and easy to
> interpret.  Mike has mostly convinced me that there exist environments
> when the two "iss" are absolutely required to be identical and are
> strictly duplicated (which lends itself naturally to the status quo). 
> But since I don't understand these cases very well, I'm concerned
> about how to identify those environments and whether there would be
> interop issues if such an environment contained an actor that also had
> to interact with a more generic environment.
>
>
>     My concern is that we are too compatible with existing code. SETs
>     can easily be confused as ID Tokens as existing ID Token parsers
>     will ignore the events attribute and will see all the normal
>     claims for an ID Token as being present.  If you can address this,
>     then I can live with the status quo.
>
>      
>
>
> I don't think I have anything to offer to help on the disambiguation
> of ID tokens and SETs issue.
>
> -Ben
>
>
>     Are they any that have issues with the current draft (in order to
>     get back to Yaron’s question)? The current draft allows multiple
>     iss values to appear in different places in the JSON structure
>     based on profiling specification definition.
>
>      
>
>     Phil
>
>      
>
>     Oracle Corporation, Identity Cloud Services & Identity Standards
>
>     @independentid
>
>     www.independentid.com
>     <https://urldefense.proofpoint.com/v2/url?u=http-3A__www.independentid.com&d=DwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=sssDLkeEEBWNIXmTsdpw8TZ3tAJx-Job4p1unc7rOhM&m=OndKKucFPayCxClqGiVktItU3lmkVkSzQBxUvBmLEik&s=Ijhk2wjlr4V4-fswCLBGE38fdK1gwFfUY66tfJf7a24&e=>
>
>     [e-mail] <mailto:[e-mail]>
>
>      
>
>      
>
>      
>
>      
>
>      
>
>      
>
>         On Mar 7, 2017, at 9:29 AM, Mike Jones
>         <[e-mail]
>         <mailto:[e-mail]>> wrote:
>
>          
>
>         No, it’s not possible to require that “sub” be globally unique
>         because for important use cases, it’s relative to the issuer. 
>         Trying to force it to be a URI would unnecessarily limit the
>         applicability of the SET spec, causing some applications to
>         simply decide to not use it as a result.
>
>          
>
>         If some use cases want a kind of logout event that’s issued by
>         a different party than the IdP, then the current spec lets
>         that new event be defined.  It will require more parameters
>         than the current logout event, but that’s OK, since it’s used
>         in different contexts.
>
>          
>
>         In my view, it’s not editorially lazy to allow events to
>         define what claims they need.  It’s an intentional choice,
>         which enables the simple cases to be simply expressed, while
>         also enabling more complicated cases carrying more information
>         to be expressed.
>
>          
>
>         Trying to force the simple events use extra syntax only
>         actually needed for complicated events would be a severe
>         architectural mistake on our part.
>
>          
>
>                                                                -- Mike
>
>          
>
>         *From:* Id-event [mailto:[e-mail]] *On Behalf
>         Of *Phil Hunt
>         *Sent:* Tuesday, March 7, 2017 8:13 AM
>         *To:* ID Events Mailing List <[e-mail]
>         <mailto:[e-mail]>>
>         *Subject:* Re: [Id-event] Thread: Clarifying use of sub and
>         iss in SET tokens
>
>          
>
>          
>
>         Just to refresh everyone...
>
>          
>
>         As editor, my feeling is we have no *clean* or *simple*
>         solution because we have to use “iss” to mean the issuer of
>         the SET in order to comply with JWT and because OIDC conflates
>         assertion issuer with subject issuer, it makes it difficult to
>         uniquely identify a “sub” value because some events want to
>         use “iss” for 2 purposes (to identify the event issuer vs. the
>         subject issuer).
>
>          
>
>         None of the solutions presented are actually easy to explain.
>         So far, I’ve sided with Mike and William because they feel it
>         is close enough and it was editorially lazy (say nothing). I
>         am worried that this is actually complex for developers who do
>         not know the history of how JWTs emerged.
>
>          
>
>         Let’s look at the examples we already have. Notice that in the
>         current draft, there are 3 separate ways of expressing the
>         subject of an event….
>
>          
>
>         Scenario 1, the event issuer and subject issuer are the same:
>
>          
>
>            {
>
>               "iss": "https://server.example.com
>         <https://urldefense.proofpoint.com/v2/url?u=https-3A__server.example.com_&d=DwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=sssDLkeEEBWNIXmTsdpw8TZ3tAJx-Job4p1unc7rOhM&m=OndKKucFPayCxClqGiVktItU3lmkVkSzQBxUvBmLEik&s=aZmCu-T30ddM7EO5MTTcZLtFvxVBsTqvt157yHUeOIU&e=>",
>
>               "sub": "248289761001",
>
>               "aud": "s6BhdRkqt3",
>
>               "iat": 1471566154,
>
>               "jti": "bWJq",
>
>               "sid": "08a5019c-17e1-4977-8f42-65a12843ea02",
>
>               "events": {
>
>                 "http://schemas.openid.net/event/backchannel-logout
>         <https://urldefense.proofpoint.com/v2/url?u=http-3A__schemas.openid.net_event_backchannel-2Dlogout&d=DwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=sssDLkeEEBWNIXmTsdpw8TZ3tAJx-Job4p1unc7rOhM&m=OndKKucFPayCxClqGiVktItU3lmkVkSzQBxUvBmLEik&s=qmlNwMQZyc4wKMGYlcbHv4N_qYgxNWYhJxV9x_obkMQ&e=>":
>         {}
>
>               }
>
>            }
>
>          
>
>         Scenario 2, a relying party is issuing an event, event iss and
>         sub iss are different and thus there are repeat iss values:
>
>          
>
>            {
>
>              "jti": "fb4e75b5411e4e19b6c0fe87950f7749",
>
>          
>
>              "sub": "248289761001",
>
>              "iat": 1458496025,
>
>              "iss": "https://my.examplemed.com
>         <https://urldefense.proofpoint.com/v2/url?u=https-3A__my.examplemed.com_&d=DwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=sssDLkeEEBWNIXmTsdpw8TZ3tAJx-Job4p1unc7rOhM&m=OndKKucFPayCxClqGiVktItU3lmkVkSzQBxUvBmLEik&s=ZkLctIH2dAoi4hhkPymZDQingbkQfHt9YgekAMKelaQ&e=>",
>
>              "aud": [
>
>                "https://rp.example.com
>         <https://urldefense.proofpoint.com/v2/url?u=https-3A__rp.example.com_&d=DwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=sssDLkeEEBWNIXmTsdpw8TZ3tAJx-Job4p1unc7rOhM&m=OndKKucFPayCxClqGiVktItU3lmkVkSzQBxUvBmLEik&s=gpNhu-LU43cxIyrYhVcrMto66IZz2Jxwa5lzPpxVTD0&e=>"
>
>              ],
>
>              "events": {
>
>                "https://openid.net/heart/specs/consent.html
>         <https://urldefense.proofpoint.com/v2/url?u=https-3A__openid.net_heart_specs_consent.html&d=DwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=sssDLkeEEBWNIXmTsdpw8TZ3tAJx-Job4p1unc7rOhM&m=OndKKucFPayCxClqGiVktItU3lmkVkSzQBxUvBmLEik&s=0Z-ohlyQps3JNPgGR0j_zY-sRZI274Y9zMivRDXjmis&e=>":{
>
>                  "iss":"https://connect.example.com
>         <https://urldefense.proofpoint.com/v2/url?u=https-3A__connect.example.com_&d=DwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=sssDLkeEEBWNIXmTsdpw8TZ3tAJx-Job4p1unc7rOhM&m=OndKKucFPayCxClqGiVktItU3lmkVkSzQBxUvBmLEik&s=KpM1_m5EiidPDJVV4EzmfBTYG6hneVcT8hymd-6p1BI&e=>",
>
>                  "consentUri":[
>
>                  
>          "https://terms.examplemed.com/labdisclosure.html#Agree
>         <https://urldefense.proofpoint.com/v2/url?u=https-3A__terms.examplemed.com_labdisclosure.html-23Agree&d=DwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=sssDLkeEEBWNIXmTsdpw8TZ3tAJx-Job4p1unc7rOhM&m=OndKKucFPayCxClqGiVktItU3lmkVkSzQBxUvBmLEik&s=AAdiJeFhv-D7NndiSyTUpmxuwaxrG64CU2JvbKF1lc0&e=>"
>
>                  ]
>
>                }
>
>              }
>
>            }
>
>          
>
>         Scenario  3:  sub is universally unique:
>
>          
>
>            {
>
>              "jti": "3d0c3cf797584bd193bd0fb1bd4e7d30",
>
>              "iat": 1458496025,
>
>              "iss": "https://scim.example.com
>         <https://urldefense.proofpoint.com/v2/url?u=https-3A__scim.example.com_&d=DwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=sssDLkeEEBWNIXmTsdpw8TZ3tAJx-Job4p1unc7rOhM&m=OndKKucFPayCxClqGiVktItU3lmkVkSzQBxUvBmLEik&s=LyBq6tEQAe7jo3Yewc_F77-CHuOYZwsa4UYyVPDCFpc&e=>",
>
>              "aud": [
>
>              
>          "https://jhub.example.com/Feeds/98d52461fa5bbc879593b7754
>         <https://urldefense.proofpoint.com/v2/url?u=https-3A__jhub.example.com_Feeds_98d52461fa5bbc879593b7754&d=DwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=sssDLkeEEBWNIXmTsdpw8TZ3tAJx-Job4p1unc7rOhM&m=OndKKucFPayCxClqGiVktItU3lmkVkSzQBxUvBmLEik&s=mOuO83TTWdG12H5jGxLpWICeVgNxA5q5xMAegwYiPeg&e=>",
>
>              
>          "https://jhub.example.com/Feeds/5d7604516b1d08641d7676ee7
>         <https://urldefense.proofpoint.com/v2/url?u=https-3A__jhub.example.com_Feeds_5d7604516b1d08641d7676ee7&d=DwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=sssDLkeEEBWNIXmTsdpw8TZ3tAJx-Job4p1unc7rOhM&m=OndKKucFPayCxClqGiVktItU3lmkVkSzQBxUvBmLEik&s=SgkQ6fsaS-Le8I4wi1GGygVQsEZLxoN8sZQS3NvgZis&e=>"
>
>              ],
>
>              "sub":
>         "https://scim.example.com/Users/44f6142df96bd6ab61e7521d9
>         <https://urldefense.proofpoint.com/v2/url?u=https-3A__scim.example.com_Users_44f6142df96bd6ab61e7521d9&d=DwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=sssDLkeEEBWNIXmTsdpw8TZ3tAJx-Job4p1unc7rOhM&m=OndKKucFPayCxClqGiVktItU3lmkVkSzQBxUvBmLEik&s=FiGG_pwSjXMTe-zrlpNBMrFityNSwQdBVfjvDFMV1QE&e=>",
>
>              "events": {
>
>                "urn:ietf:params:scim:event:passwordReset":
>
>                  { "id":"44f6142df96bd6ab61e7521d9"},
>
>                "https://example.com/scim/event/passwordResetExt
>         <https://urldefense.proofpoint.com/v2/url?u=https-3A__example.com_scim_event_passwordResetExt&d=DwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=sssDLkeEEBWNIXmTsdpw8TZ3tAJx-Job4p1unc7rOhM&m=OndKKucFPayCxClqGiVktItU3lmkVkSzQBxUvBmLEik&s=l9vO69P8yOSS_2Gd_1ya8bJyBLwhFj_fl3yZG9ovzXo&e=>":
>
>                  { "resetAttempts":5}
>
>              }
>
>            }
>
>          
>
>         I believe the current argument is that profiling specs
>         explains how their events are to be parsed. This means for
>         multi-event parsers, subject is inconsistent and potentially
>         not mappable.  The BackChannel Logout event is currently
>         structured for only the OP to issue. However Oracle wants that
>         to be bi-directional so that web sites can notify the IDP/OP
>         that the user has logged out of a specific web site.  If that
>         happens, BackChannel logout will have methods 1 and 2 required.
>
>          
>
>         Would it be possible for events to require that “sub” be
>         globally unique — e.g. expressed as a url.  For example, in
>         order for backchannel to be issued by an OP or an RP, it would
>         be expressed with sub as a URL ("sub":
>         “https://server.example.com/248289761001
>         <https://urldefense.proofpoint.com/v2/url?u=https-3A__server.example.com_248289761001&d=DwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=sssDLkeEEBWNIXmTsdpw8TZ3tAJx-Job4p1unc7rOhM&m=OndKKucFPayCxClqGiVktItU3lmkVkSzQBxUvBmLEik&s=5Rnz1dzOEoK27YDktq_HMGneutBpDod8-iAqU1CgizQ&e=>”,):
>
>            {
>
>               "iss": "https://www.exampleapp.com
>         <https://urldefense.proofpoint.com/v2/url?u=https-3A__www.exampleapp.com_&d=DwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=sssDLkeEEBWNIXmTsdpw8TZ3tAJx-Job4p1unc7rOhM&m=OndKKucFPayCxClqGiVktItU3lmkVkSzQBxUvBmLEik&s=KuoD7Qelh1vowEZDz-WSjpIwC7vlR410B8RPsdfQg20&e=>",
>
>               "sub": “https://server.example.com/248289761001
>         <https://urldefense.proofpoint.com/v2/url?u=https-3A__server.example.com_248289761001&d=DwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=sssDLkeEEBWNIXmTsdpw8TZ3tAJx-Job4p1unc7rOhM&m=OndKKucFPayCxClqGiVktItU3lmkVkSzQBxUvBmLEik&s=5Rnz1dzOEoK27YDktq_HMGneutBpDod8-iAqU1CgizQ&e=>",
>
>               "aud": "s6BhdRkqt3",
>
>               "iat": 1471566154,
>
>               "jti": "bWJq",
>
>               "sid": "08a5019c-17e1-4977-8f42-65a12843ea02",
>
>               "events": {
>
>                 "http://schemas.openid.net/event/backchannel-logout
>         <https://urldefense.proofpoint.com/v2/url?u=http-3A__schemas.openid.net_event_backchannel-2Dlogout&d=DwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=sssDLkeEEBWNIXmTsdpw8TZ3tAJx-Job4p1unc7rOhM&m=OndKKucFPayCxClqGiVktItU3lmkVkSzQBxUvBmLEik&s=qmlNwMQZyc4wKMGYlcbHv4N_qYgxNWYhJxV9x_obkMQ&e=>":
>         {}
>
>               }
>
>          
>
>         At least this way iss is never duplicated and sub is always
>         the addressable subject of the event regardless of the type of
>         event.  That would enable all 3 cases to be expressed one way
>         for all specs.  That seems simple to me (at least from how I
>         would define this in the spec).  
>
>          
>
>         I had thought Justin was advocating a 4th option which is to
>         always embed “sub” and “iss” in the event payload.  So you
>         would end up with something like:
>
>            {
>
>              "jti": "fb4e75b5411e4e19b6c0fe87950f7749",
>
>              "iat": 1458496025,
>
>             _ "iss": "https://my.examplemed.com
>         <https://urldefense.proofpoint.com/v2/url?u=https-3A__my.examplemed.com_&d=DwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=sssDLkeEEBWNIXmTsdpw8TZ3tAJx-Job4p1unc7rOhM&m=OndKKucFPayCxClqGiVktItU3lmkVkSzQBxUvBmLEik&s=ZkLctIH2dAoi4hhkPymZDQingbkQfHt9YgekAMKelaQ&e=>",_
>
>              "aud": [
>
>                "https://rp.example.com
>         <https://urldefense.proofpoint.com/v2/url?u=https-3A__rp.example.com_&d=DwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=sssDLkeEEBWNIXmTsdpw8TZ3tAJx-Job4p1unc7rOhM&m=OndKKucFPayCxClqGiVktItU3lmkVkSzQBxUvBmLEik&s=gpNhu-LU43cxIyrYhVcrMto66IZz2Jxwa5lzPpxVTD0&e=>"
>
>              ],
>
>              "events": {
>
>                "https://openid.net/heart/specs/consent.html
>         <https://urldefense.proofpoint.com/v2/url?u=https-3A__openid.net_heart_specs_consent.html&d=DwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=sssDLkeEEBWNIXmTsdpw8TZ3tAJx-Job4p1unc7rOhM&m=OndKKucFPayCxClqGiVktItU3lmkVkSzQBxUvBmLEik&s=0Z-ohlyQps3JNPgGR0j_zY-sRZI274Y9zMivRDXjmis&e=>":{
>
>                 _ "sub": "248289761001",_
>
>         _         "iss":"https://my.examplemed.com
>         <https://urldefense.proofpoint.com/v2/url?u=https-3A__my.examplemed.com_&d=DwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=sssDLkeEEBWNIXmTsdpw8TZ3tAJx-Job4p1unc7rOhM&m=OndKKucFPayCxClqGiVktItU3lmkVkSzQBxUvBmLEik&s=ZkLctIH2dAoi4hhkPymZDQingbkQfHt9YgekAMKelaQ&e=>",_
>
>                  "consentUri":[
>
>                  
>          "https://terms.examplemed.com/labdisclosure.html#Agree
>         <https://urldefense.proofpoint.com/v2/url?u=https-3A__terms.examplemed.com_labdisclosure.html-23Agree&d=DwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=sssDLkeEEBWNIXmTsdpw8TZ3tAJx-Job4p1unc7rOhM&m=OndKKucFPayCxClqGiVktItU3lmkVkSzQBxUvBmLEik&s=AAdiJeFhv-D7NndiSyTUpmxuwaxrG64CU2JvbKF1lc0&e=>"
>
>                  ]
>
>                }
>
>              }
>
>            }
>
>          
>
>         Note that in the above example, “iss” would always be present
>         even if “iss” is the *same*.  The rule would be that the iss
>         and sub are in the payload and that addresses the subject of
>         the event. The envelope level is always reserved for event
>         validation and addressing only.  While some would argue this
>         is ugly, I can see some merits as it is at least consistent.
>
>          
>
>          
>
>         Phil
>
>          
>
>         Oracle Corporation, Identity Cloud Services & Identity Standards
>
>         @independentid
>
>         www.independentid.com
>         <https://urldefense.proofpoint.com/v2/url?u=http-3A__www.independentid.com_&d=DwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=sssDLkeEEBWNIXmTsdpw8TZ3tAJx-Job4p1unc7rOhM&m=OndKKucFPayCxClqGiVktItU3lmkVkSzQBxUvBmLEik&s=B_jjXc15tMFqi9Ef2x7fWuBKYckJ2pchgc61F80QAWA&e=>
>
>         [e-mail] <mailto:[e-mail]>
>
>          
>
>          
>
>          
>
>          
>
>          
>
>          
>
>             On Mar 7, 2017, at 7:26 AM, Justin Richer <[e-mail]
>             <mailto:[e-mail]>> wrote:
>
>              
>
>             +1
>
>              
>
>             On 3/6/2017 7:55 PM, Benjamin Kaduk wrote:
>
>                 On 03/06/2017 06:39 PM, Mike Jones wrote:
>
>
>                     Justin, I suspect you didn’t see my earlier reply
>                     to Phil’s note that you also replied to, so I’m
>                     repeating it here and sending it to you directly. 
>                     (It wouldn’t be the first time that DMARC policies
>                     caused some of my contributions to be not received
>                     by some participants. :-( )
>
>                      
>
>                     Agreed that this is unclear.  Duplicating
>                     information in a protocol **always** introduces an
>                     unnecessary error case – the need to define how to
>                     handle the situation in which two pieces of
>                     information that are required to be identical are
>                     different.  Information in a SET should occur at
>                     most once.
>
>                      
>
>
>                 That seems a dangerous road to tread, as it requires
>                 care in defining "information" -- duplicating the same
>                 data strings at different levels of the hierarchy of a
>                 JSON object may very well not be duplicating
>                 information, due to the extra context provided by the
>                 hierarchy.  In my mind, it's not a clear case that you
>                 should never send the same name/value multiple times
>                 in different parts of an object, as sometimes it is
>                 good to keep the semantic separation clear.
>
>                 -Ben
>
>              
>
>          
>
>         _______________________________________________
>         Id-event mailing list
>         [e-mail] <mailto:[e-mail]>
>         https://www.ietf.org/mailman/listinfo/id-event
>         <https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_id-2Devent&d=DwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=sssDLkeEEBWNIXmTsdpw8TZ3tAJx-Job4p1unc7rOhM&m=OndKKucFPayCxClqGiVktItU3lmkVkSzQBxUvBmLEik&s=GvCU0sssYF2cnSpnUau9N2MD6u_C3mtzrBtqNOwmKi0&e=>
>
>      
>
>
>
>
>     _______________________________________________
>
>     Id-event mailing list
>
>     [e-mail] <mailto:[e-mail]>
>
>     https://www.ietf.org/mailman/listinfo/id-event
>     <https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_id-2Devent&d=DwMFAg&c=96ZbZZcaMF4w0F4jpN6LZg&r=sssDLkeEEBWNIXmTsdpw8TZ3tAJx-Job4p1unc7rOhM&m=Ma3MDbWVFnIyFGL2K_OCpMN37A8gsJRuyz6AIcbA7TA&s=og1z-m3kp2hcMYwqmJGL_8FwUfmQRoyAMzwqOCfMz1E&e=>
>
>  
>