Re: [websec] Well-known URIs

[Mark Nottingham <[e-mail]>]

On 09/08/2013, at 3:31 AM, Chris Palmer <[e-mail]> wrote:

> On Thu, Aug 8, 2013 at 5:35 AM, Mark Nottingham <[e-mail]> wrote:
> 
>> 1. Well-known URIs are designed for cases where the client wants to get a bunch of *related* data together; as such, a general framework is encouraged, as long as the use cases are similar.
>> 
>> This is why I don't like hostmeta; it's a bucket for anything you want to throw in there, which means that over time, the client will be getting a lot of information they don't want, which will necessitate a query language, which is just nasty overkill. At the other end of the spectrum, having a single-use well-known URI in the critical path (or even not) for a browser is similarly Not A Good Idea.
> 
> Can you say clearly what else we should stuff into the W-K URI for
> HPKP? What other working groups and standards bodies are we going to
> have to reach consensus with?

Um, implementers?

> 
>> 3. Alternatively, if browsers are pre connecting, they could use the conn to fetch a well-known URI, as long as it was cheap to fetch. That policy file could even control how aggressively the browser pre-connects (two birds, one stone…).
> 
> You just said it should *not* become a catch-all bucket.

It's a subtle thing. You want things that tend to be accessed at the same time, by the same clients; that's the shape of the bucket. They may or may not be related conceptually; it's all about audience (sort of like user-centred design).

Cheers,



--
Mark Nottingham   http://www.mnot.net/