Re: [Trans] Some comments on the Web Service part

On Wed, Mar 5, 2014 at 6:41 PM, Phillip Hallam-Baker <hallam@gmail.com>wrote:

> 1) This is a specified service, shouldn't it be registered as a
> .well-known service?
>
> http://example.com/.well-known/ct/1
>
> This means that the CT log can play nice with other services on the same
> server.
>
> (obviously have to replace ct with what we register)
>
Could you please point to the standard specifying how these well-known
services are defined?
Regardless, it seems to be independent of the commands specification that a
CT log must conform to.
The Google-managed logs have an address that conforms with the rest of the
HTTP APIs Google offers. We technically could offer
https://ct.googleapis.com/.well-known/..., if it provides strong benefit.
Since we expect few, well-known logs, I can't see the benefit in
registering it as well-known service since very few domains are expected to
offer it (i.e. there is no benefit it making it easily discoverable).

>
>
> 2) The command should be present in the JSON request.
>
> Do you mean this as an addition or instead of specifying the command in
the request line?
Is there a specific web traffic management system that you know/expect to
cause problem?

> HTTP request lines are hard to protect with message level authentication.
> Putting the command in the content means that it is covered independently.
>
> Reason this matters is that the request line and headers tend to get
> 'battered' as they pass through enterprise scale web traffic management
> systems. The same is true of TLS authentication that tends to get stripped
> out at the front door by some sort of message router.
>
>
>
>
> --
> Website: http://hallambaker.com/
>
> _______________________________________________
> Trans mailing list
> Trans@ietf.org
> https://www.ietf.org/mailman/listinfo/trans
>
>