Subject: Re: [Trans] Some comments on the Web Service part
From: Eran Messeri <[email-masked]>
To: Phillip Hallam-Baker <[email-masked]>
Cc: "[email-masked]" <[email-masked]>
Date: Thu, 6 Mar 2014 11:29:50 +0000
List-Id: Public Notary Transparency working group discussion list <trans.ietf.org>

On Wed, Mar 5, 2014 at 6:41 PM, Phillip Hallam-Baker <[email-masked]>wrote:

> 1) This is a specified service, shouldn't it be registered as a
> .well-known service?
>
> http://example.com/.well-known/ct/1
>
> This means that the CT log can play nice with other services on the same
> server.
>
> (obviously have to replace ct with what we register)
>
Could you please point to the standard specifying how these well-known
services are defined?
Regardless, it seems to be independent of the commands specification that a
CT log must conform to.
The Google-managed logs have an address that conforms with the rest of the
HTTP APIs Google offers. We technically could offer
https://ct.googleapis.com/.well-known/..., if it provides strong benefit.
Since we expect few, well-known logs, I can't see the benefit in
registering it as well-known service since very few domains are expected to
offer it (i.e. there is no benefit it making it easily discoverable).

>
>
> 2) The command should be present in the JSON request.
>
> Do you mean this as an addition or instead of specifying the command in
the request line?
Is there a specific web traffic management system that you know/expect to
cause problem?

> HTTP request lines are hard to protect with message level authentication.
> Putting the command in the content means that it is covered independently.
>
> Reason this matters is that the request line and headers tend to get
> 'battered' as they pass through enterprise scale web traffic management
> systems. The same is true of TLS authentication that tends to get stripped
> out at the front door by some sort of message router.
>
>
>
>
> --
> Website: http://hallambaker.com/
>
> _______________________________________________
> Trans mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/trans
>
>