Scope of application/* media types (was: Protocol changes in draft-allbery-usefor-usepro-00)

[Russ Allbery <[e-mail]>]

Charles Lindsey <[e-mail]> writes:
> Russ Allbery <[e-mail]> writes:
>> Charles Lindsey <[e-mail]> writes:

>>> 26. [-1] (4.2,4.3) Removed requirement that
>>> application/news-[groupinfo,checkgroups] MUST NOT be used except with
>>> relevant control messages.

>>> Application types are inherently dangerous ...

>> Intentional change.

>> I can't think of an example of how application/news-groupinfo could be
>> dangerous.  It's nothing but a bit of text giving a newsgroup name and a
>> description.  In and of itself, it has no force, power, or action
>> whatsoever.

> Application types are intended to cause applications to be invoked, with
> possible side effects.

Could you provide a reference for this?  I don't see this statement in RFC
2046.  The closest that it has is:

   The "application" media type is to be used for discrete data which do
   not fit in any of the other categories, and particularly for data to
   be processed by some type of application program.  This is
   information which must be processed by an application before it is
   viewable or usable by a user.

"To be processed" is far from saying that reception of an application type
will cause an application to be invoked.  application/octet-stream is an
obvious counter-example to this interpretation.

Our case falls into the general scope ("discrete data which do not fit in
any of the other categories") but not fully into the specific one ("data
to be processed by some type of application program").  Our media types
are actually text/* types; the only reason why they're not declared as
such is because text/* comes with baggage involving CTEs that we can't
accept.  Declaring them as application/* is in essence a hack around the
MIME object structure, although unfortunately a necessary one.

> In this case, the side efect is that a line gets added/changed in the
> Newsgroups file.

I don't agree with this interpretation, and I don't see anything in the
text of the application/news-groupinfo registration that reflects this.
It sounds to me like you're confusing the newgroup control message with
the application/news-groupinfo MIME media type.  They're not the same
thing.

> OK, in that case what you need to say is:

>     This media type is intended to be used in conjunction with the
>     newgroup control message as described in section 5.2.1. It MUST NOT be
>     automatically invoked in any other context without explicit human
>     intervention.

> and similarly for checkgroups.

I disagree with adding anything like this to our document.  When we just
defined the media type to contain simple text and nothing in the
description of the media type says anything about treating that text as
instructions to a computer program, this seems to me to just be confusing.
There's nothing here to invoke; it's just an association between newsgroup
names and descriptions.

-- 
Russ Allbery ([e-mail])             <http://www.eyrie.org/~eagle/>