Re: [T2TRG] [core] Disclosing Implementation Information: draft-bormann-t2trg-rel-impl-01.txt

Carsten Bormann <cabo@tzi.org> Sun, 29 March 2020 12:47 UTC

Return-Path: <cabo@tzi.org>
X-Original-To: t2trg@ietfa.amsl.com
Delivered-To: t2trg@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7C73B3A079A for <t2trg@ietfa.amsl.com>; Sun, 29 Mar 2020 05:47:55 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: 0.001
X-Spam-Level:
X-Spam-Status: No, score=0.001 tagged_above=-999 required=5 tests=[SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id koThhQGcAqWB for <t2trg@ietfa.amsl.com>; Sun, 29 Mar 2020 05:47:53 -0700 (PDT)
Received: from gabriel-vm-2.zfn.uni-bremen.de (gabriel-vm-2.zfn.uni-bremen.de [134.102.50.17]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E7F6B3A07CB for <t2trg@irtf.org>; Sun, 29 Mar 2020 05:47:52 -0700 (PDT)
Received: from [192.168.217.119] (p548DCD70.dip0.t-ipconnect.de [84.141.205.112]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by gabriel-vm-2.zfn.uni-bremen.de (Postfix) with ESMTPSA id 48qwNg1sQ3zyRf; Sun, 29 Mar 2020 14:47:47 +0200 (CEST)
Content-Type: text/plain; charset="utf-8"
Mime-Version: 1.0 (Mac OS X Mail 13.0 \(3608.60.0.2.5\))
From: Carsten Bormann <cabo@tzi.org>
In-Reply-To: <HE1PR07MB4346BBD0DC88E28D1CAD1D4DE6CA0@HE1PR07MB4346.eurprd07.prod.outlook.com>
Date: Sun, 29 Mar 2020 14:47:46 +0200
Cc: "t2trg@irtf.org" <t2trg@irtf.org>, "core@ietf.org WG" <core@ietf.org>
X-Mao-Original-Outgoing-Id: 607178866.7292809-40e68d1897cc197107280e0c91218aac
Content-Transfer-Encoding: quoted-printable
Message-Id: <73646235-8594-4E63-866E-8F3ACFB0F2CB@tzi.org>
References: <158532472527.24402.7156077840539978248@ietfa.amsl.com> <C1A0817E-8243-49A7-9CEA-BD38270C5028@tzi.org> <HE1PR07MB4346BBD0DC88E28D1CAD1D4DE6CA0@HE1PR07MB4346.eurprd07.prod.outlook.com>
To: Klaus Hartke <klaus.hartke@ericsson.com>
X-Mailer: Apple Mail (2.3608.60.0.2.5)
Archived-At: <https://mailarchive.ietf.org/arch/msg/t2trg/ttrMCgs55DKueHKrohqmqaCCsog>
Subject: Re: [T2TRG] [core] Disclosing Implementation Information: draft-bormann-t2trg-rel-impl-01.txt
X-BeenThere: t2trg@irtf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: IRTF Thing-to-Thing Research Group <t2trg.irtf.org>
List-Unsubscribe: <https://www.irtf.org/mailman/options/t2trg>, <mailto:t2trg-request@irtf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/t2trg/>
List-Post: <mailto:t2trg@irtf.org>
List-Help: <mailto:t2trg-request@irtf.org?subject=help>
List-Subscribe: <https://www.irtf.org/mailman/listinfo/t2trg>, <mailto:t2trg-request@irtf.org?subject=subscribe>
X-List-Received-Date: Sun, 29 Mar 2020 12:47:56 -0000

On 2020-03-29, at 14:08, Klaus Hartke <klaus.hartke@ericsson.com> wrote:
> 
> Would it make sense to standardize how to exactly express the information about the implementation and version? Being able to find that information seems useful -- but incomplete :-)

If we want to encourage clients changing their behavior based on what they find, as in your example below: Yes.
If not:
The resource at the other end of the link has a media type.

We could still go ahead and define one or more media types for this.
I’m just not sure that we’ll find more commonality than text/plain or text/html here.
(We could find ourselves in security.txt land, though [1].  Hmm.)

> And then I'm wondering if there's a risk that we might end up with something like this in the future:
> 
> 1. Client makes a GET request on the implementation information resource
> 2. Server returns a string like "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36"
> 3. Client behaves differently based on the implementation information

Any way of standardizing self-describing information increases this risk of sniffing against that.
Implementations might react on impl-info or on the mere fact that the temperature sensor resource is called “/temp” and not “/t”...

Grüße, Carsten

[1]: https://securitytxt.org/