Re: [websec] Well-known URIs

[Chris Palmer <[e-mail]>]

On Thu, Aug 8, 2013 at 5:35 AM, Mark Nottingham <[e-mail]> wrote:

> 1. Well-known URIs are designed for cases where the client wants to get a bunch of *related* data together; as such, a general framework is encouraged, as long as the use cases are similar.
>
> This is why I don't like hostmeta; it's a bucket for anything you want to throw in there, which means that over time, the client will be getting a lot of information they don't want, which will necessitate a query language, which is just nasty overkill. At the other end of the spectrum, having a single-use well-known URI in the critical path (or even not) for a browser is similarly Not A Good Idea.

Can you say clearly what else we should stuff into the W-K URI for
HPKP? What other working groups and standards bodies are we going to
have to reach consensus with?

> 3. Alternatively, if browsers are pre connecting, they could use the conn to fetch a well-known URI, as long as it was cheap to fetch. That policy file could even control how aggressively the browser pre-connects (two birds, one stone…).

You just said it should *not* become a catch-all bucket.