Re: [Uri-review] Requesting review for 'dvx' provisional registration draft

Hi Clemens,

Thanks for your note.  There appears to be no collision with an existing
registered scheme, so that's good news.  In going through the syntax, I did
have some questions, if you don't mind.

My reading is that there are two current commands, open and close, but that
you intend for the syntax to be extensible.  The permitted characters for
new commands are a-z0-9.+-, and there is no restriction on their ordering.
That would mean 99open, +-7a, even + as a bare operator would be valid; is
that your intent, or did you also want to have minimum lengths and require
certain patterns?

For "the interoperability considerations", you might simply mention that
there is currently only one known context of use (the ORGAPLAN context,
listed below), and that uses of this outside that context may or may not
conform.

For security considerations, I could not quite parse what you meant:

For security reasons it's prohibited to include sensitive or private
information in the uri. This applies in particular to the key=value pairs.
The restrictions on a requested resource or command need to be checked by
the application which evaluates the uri

For example, are you indicating that the URI might be carried in a plain
text protocol, and thus be observable to an attacker with access to the
path?  If that's the threat model, it would appear  the application that
evaluates the URI (on receipt), might be acting too late to prevent
observation.   In general you might want to reference rFC 3552 for text on
how security considerations text is constructed.

Thanks again for sending this note,

regards,

Ted Hardie

Your document says "The encoding of the key=value pairs follow the rules
defined in RFC3986 "Uniform Resource Identifier (URI): Generic Syntax"
Section 2 <https://datatracker.ietf.org/doc/html/rfc3986#section-2>" .
It's not entirely clear to me which part of that section you wish to draw
the reader's attention to.  Is it possible you meant section 3.4, which
describes path elements and mentions key value pairs?

On Thu, Jul 1, 2021 at 5:54 AM C. Bastian | ORGAPLAN <
clemens.bastian@orgaplan.org> wrote:

> Hello! I hope you can provide me some feedback on this draft for a
> provisional registration of the scheme 'dvx'.
> Here's my current draft, any feedback and hints are appreciated. Best
> greetings Clemens
>
> Scheme name:
>       dvx
>
> Status:
>      Provisional
>
> Applications/protocols that use this scheme name:
>      The ERP software solution named "DVX" by ORGAPLAN business
> solutions (www.orgaplan.org)
>
> Contact:
>      Registration applicant: Clemens Bastian <clemens.bastian@orgaplan.org
> >
>      Scheme creator: ORGAPLAN business solutions GmbH <info@orgaplan.org>
>
> Change controller:
>      Someone who is verified to represent ORGAPLAN business solutions
> GmbH (see 'Contact')
>
> References:
>      Specification:
> https://api.orgaplan.org/articles/uri-dvx-scheme-specification.html
>
> _______________________________________________
> Uri-review mailing list
> Uri-review@ietf.org
> https://www.ietf.org/mailman/listinfo/uri-review
>