MIME-Version: 1.0
In-Reply-To: <CAMm+LwipgTevGFqs0PphNTpn=1ZZgSjVVvMe2Srco4JN8F_fQg@mail.gmail.com>
References: <CAMm+LwipgTevGFqs0PphNTpn=1ZZgSjVVvMe2Srco4JN8F_fQg@mail.gmail.com>
Date: Thu, 6 Mar 2014 11:29:50 +0000
Message-ID: <CALzYgEctzKxXJzG43qJJbqsZmT36Z+TkP_woZAYZ3ha2vhSKyg@mail.gmail.com>
From: Eran Messeri <eranm@google.com>
To: Phillip Hallam-Baker <hallam@gmail.com>
Content-Type: multipart/alternative; boundary=001a1135f1b096d94604f3ee741f
Archived-At: http://mailarchive.ietf.org/arch/msg/trans/WqsDoXExStYGmtP9RZXWtGXJJjE
Cc: "trans@ietf.org" <trans@ietf.org>
Subject: Re: [Trans] Some comments on the Web Service part
Precedence: list

--001a1135f1b096d94604f3ee741f
Content-Type: text/plain; charset=UTF-8

On Wed, Mar 5, 2014 at 6:41 PM, Phillip Hallam-Baker <hallam@gmail.com>wrote:

> 1) This is a specified service, shouldn't it be registered as a
> .well-known service?
>
> http://example.com/.well-known/ct/1
>
> This means that the CT log can play nice with other services on the same
> server.
>
> (obviously have to replace ct with what we register)
>
Could you please point to the standard specifying how these well-known
services are defined?
Regardless, it seems to be independent of the commands specification that a
CT log must conform to.
The Google-managed logs have an address that conforms with the rest of the
HTTP APIs Google offers. We technically could offer
https://ct.googleapis.com/.well-known/..., if it provides strong benefit.
Since we expect few, well-known logs, I can't see the benefit in
registering it as well-known service since very few domains are expected to
offer it (i.e. there is no benefit it making it easily discoverable).

>
>
> 2) The command should be present in the JSON request.
>
> Do you mean this as an addition or instead of specifying the command in
the request line?
Is there a specific web traffic management system that you know/expect to
cause problem?


> HTTP request lines are hard to protect with message level authentication.
> Putting the command in the content means that it is covered independently.
>
> Reason this matters is that the request line and headers tend to get
> 'battered' as they pass through enterprise scale web traffic management
> systems. The same is true of TLS authentication that tends to get stripped
> out at the front door by some sort of message router.
>
>
>
>
> --
> Website: http://hallambaker.com/
>
> _______________________________________________
> Trans mailing list
> Trans@ietf.org
> https://www.ietf.org/mailman/listinfo/trans
>
>

--001a1135f1b096d94604f3ee741f
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><br><div class=3D"gmail_extra"><br><br><div class=3D"gmail=
_quote">On Wed, Mar 5, 2014 at 6:41 PM, Phillip Hallam-Baker <span dir=3D"l=
tr">&lt;<a href=3D"mailto:hallam@gmail.com" target=3D"_blank">hallam@gmail.=
com</a>&gt;</span> wrote:<br>
<blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-=
left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;p=
adding-left:1ex"><div dir=3D"ltr">1) This is a specified service, shouldn&#=
39;t it be registered as a .well-known service?<br clear=3D"all">
<div><br></div><div><a href=3D"http://example.com/.well-known/ct/1" target=
=3D"_blank">http://example.com/.well-known/ct/1</a></div>
<div><br></div><div>This means that the CT log can play nice with other ser=
vices on the same server.</div><div><br></div><div>(obviously have to repla=
ce ct with what we register)</div></div></blockquote><div>Could you please =
point to the standard specifying how these well-known services are defined?=
</div>
<div>Regardless, it seems to be independent of the commands specification t=
hat a CT log must conform to.=C2=A0</div><div>The Google-managed logs have =
an address that conforms with the rest of the HTTP APIs Google offers. We t=
echnically could offer=C2=A0<a href=3D"https://ct.googleapis.com/.well-know=
n/..">https://ct.googleapis.com/.well-known/..</a>., if it provides strong =
benefit.</div>
<div>Since we expect few, well-known logs, I can&#39;t see the benefit in r=
egistering it as well-known service since very few domains are expected to =
offer it (i.e. there is no benefit it making it easily discoverable).</div>
<blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-=
left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;p=
adding-left:1ex"><div dir=3D"ltr"><div><br></div><div><br></div><div>2) The=
 command should be present in the JSON request.</div>

<div><br></div></div></blockquote><div>Do you mean this as an addition or i=
nstead of specifying the command in the request line?=C2=A0</div><div>Is th=
ere a specific web traffic management system that you know/expect to cause =
problem?</div>
<div>=C2=A0</div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px =
0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-l=
eft-style:solid;padding-left:1ex"><div dir=3D"ltr"><div></div><div>HTTP req=
uest lines are hard to protect with message level authentication. Putting t=
he command in the content means that it is covered independently.</div>
<div><br></div><div>Reason this matters is that the request line and header=
s tend to get &#39;battered&#39; as they pass through enterprise scale web =
traffic management systems. The same is true of TLS authentication that ten=
ds to get stripped out at the front door by some sort of message router.</d=
iv>
<span class=3D""><font color=3D"#888888">
<div><br></div><div><br></div><div><br></div><div><br></div>-- <br>Website:=
 <a href=3D"http://hallambaker.com/" target=3D"_blank">http://hallambaker.c=
om/</a><br>
</font></span></div>
<br>_______________________________________________<br>
Trans mailing list<br>
<a href=3D"mailto:Trans@ietf.org">Trans@ietf.org</a><br>
<a href=3D"https://www.ietf.org/mailman/listinfo/trans" target=3D"_blank">h=
ttps://www.ietf.org/mailman/listinfo/trans</a><br>
<br></blockquote></div><br></div></div>

--001a1135f1b096d94604f3ee741f--