[Uri-review] Re: draft-grimminck-safe-ioc-sharing

[Frank Denis <[e-mail]>]

H,

Using hxxp/https when sharing IoCs is already a widely adopted practice, and I think it would make sense to formalize it through a permanent registration.

Thanks to Stefan for suggesting this.

As for using illegal characters, that may not be desirable.

First, because it is very uncommon, and security researchers are likely to keep using the conventions they already rely on, which would make the registration effectively useless.

Second, these special characters are likely to break a number of URI parsers. I do not see any advantage compared with the original proposal.

-Frank.


> On 10 Apr 2026, at 17:37, Independent Submissions Editor (Eliot Lear) <[e-mail]> wrote:
> Dear URI reviewers,
> 
> The Independent Submissions Editor has received a publication request for draft-grimminck-safe-ioc-sharing.  This draft intentionally makes certain URIs unresolvable during transport.  I am contacting you because there are several legacy use cases, two in particular: http-> hxxp and https -> hxxps.  I have no doubt, but that these indicators of compromise (IOC) transformations are widely accepted as a convention.  I note that an old draft, draft-salgado-hxxp-01 has provisionally registered these schemes.  This is sufficient to limit damage with those particular schemes.  There can be other schemes that may be used to reference compromised content.
> 
> I have several questions for this group:
> 
> Stefan is considering a more generic approach that uses illegal characters in the scheme (*) for other schemes.  Do you agree that is appropriate?
> Would you like the registration for hxxp and hxxps to move to this work, should it progress?
> Would you like to mark the registrations as permanent as part of that process?
> Would you like to perform a review of the draft?  Reviewer guidance can be found at https://www.rfc-editor.org/materials/reviewer.guide.txt.
> Regards,
> 
> Eliot
> 
> 
> 
> _______________________________________________
> Uri-review mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]