Re: [Idr] WG adoption call for draft-abraitis-bgp-version-capability-08, to end September 25

[Jeffrey Haas <[e-mail]>]

Robert,

Please note that the points I'm about to make is intended to more broadly discuss the URL issue and isn't saying you're making these recommendations.

> On Jan 10, 2023, at 5:47 PM, Robert Raszuk <[e-mail]> wrote:
> 
> I would like to just highlight one IMHO very cool property hidden in yr note ... If we would use URL to carry a pointer to the information the URL can be shortened to be a fixed length of a few characters which could be really easy to process and presented  to users in a pretty uniformed way across any receiver. 

Before we move forward with any specific shortened-URL proposal, it's likely we'll want to get comment from those with expertise in the security implications of shortened URLs.

Certainly, many vendors maintain a domain name for shorter URLs for various contexts.  That's likely not the main concern.

URL shortening services are probably a Very Bad Idea since they're in an entire vector of attacks on their own.

(We also introduce all of the interesting headaches about interaction with the PKIX certificate infrastructure.  See my prior comments in the BGP autoconfiguration discussions if you're interested.)

One possible mitigation for some of the attacks given the problem to be addressed is to permit an IANA registered prefix for the URI/URL.  This means rather than carrying a potentially long URL to a specific resource, you carry something like the Private Enterprise Number's[1] instance of your registered prefix and a suffix portion of the URL.  The rest of the data is contained in the structured data at the other side of the expanded URL.

I'd encourage Donatas to continue the discussion on such structured data before we worry over-much about how to point to it in BGP. :-)

-- Jeff

[1] https://www.iana.org/assignments/enterprise-numbers/