[Uri-review] Re: draft-grimminck-safe-ioc-sharing

[Ted Hardie <[e-mail]>]

Hi Eliot,

As a meta-question was this draft brought to the IETF before going to the
ISE?  I don't see any record of it in places I would expect (DISPATCH,
SAAG), but my records may be incomplete.

After a quick read, this actually seems like something that the IETF should
consider, as there are some aspects of it that probably need wider review.
An example here is Section 9, which references how to handle IDNs.  It
describes punycode, but the overall IDNA standard should be referenced,
probably especially RFC 3490, Section 3.1.

On the question related to the existing registration, RFC 7595 says:

      There must not already be an entry with the same scheme name.  In
      the unfortunate case that there are multiple, different uses of
      the same scheme name, the Designated Expert can approve a request
      to modify an existing entry to note the separate use.

I would first contact Hugo Salgado, the original registrant, to see if he
would be willing to work with this author on the draft and to transfer the
registration.  Since the use is functionally the same (though the
surrounding advice is different), I don't see a particular need to shift
the registration, but if this is desired and the original registrant is
unavailable, I believe the designated expert could invoke the clause above
and add the new document.

regards,

Ted Hardie

On Fri, Apr 10, 2026 at 4:38 PM Independent Submissions Editor (Eliot Lear)
<[e-mail]> wrote:

> Dear URI reviewers,
>
> The Independent Submissions Editor has received a publication request for
> draft-grimminck-safe-ioc-sharing.  This draft intentionally makes certain
> URIs unresolvable during transport.  I am contacting you because there are
> several legacy use cases, two in particular: http-> hxxp and https ->
> hxxps.  I have no doubt, but that these indicators of compromise (IOC)
> transformations are widely accepted as a convention.  I note that an old
> draft, draft-salgado-hxxp-01 has provisionally registered these schemes.
> This is sufficient to limit damage with those particular schemes.  There
> can be other schemes that may be used to reference compromised content.
>
> I have several questions for this group:
>
>    - Stefan is considering a more generic approach that uses illegal
>    characters in the scheme (*) for other schemes.  Do you agree that is
>    appropriate?
>    - Would you like the registration for hxxp and hxxps to move to this
>    work, should it progress?
>    - Would you like to mark the registrations as permanent as part of
>    that process?
>    - Would you like to perform a review of the draft?  Reviewer guidance
>    can be found at https://www.rfc-editor.org/materials/reviewer.guide.txt
>    .
>
> Regards,
>
> Eliot
>
>
> _______________________________________________
> Uri-review mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
>