Subject: Re: Links in HTML data

From: Hannu Nikkanen <[email-masked]>
Date: Thu, 29 Apr 1999 11:05:13 +0300

Hi,

I believe that "what you see is what you sign" would be a better approach.

In principle, graphics could be used to insert logos of other companies or
some text, which the signer could not distinguish from the signed part.

Even if the risk is low, it may lower consumer trust, which probably is one
of the main commercial goals. 

Hannu

At 22:45 28.4.1999 +0100, you wrote:
>Don Eastlake says in his email:
>
>	"Section 3.8.1: I don't understand why sub-pages of an HTML main
>page couldn't have links back to the main page."
>
>In IOTP, where HTML is being used to describe a document such as an order
>description or a payment note, then it is, in many ways being provided as an
>alternative to a single, or multi-page "real world" document. These
>documents should not in general be :"multi-media" documents, since for
>purposes of non-refutability, the document should be self-contained and not
>reliant on other records held elsewhere. For this reason links should only
>be used to allow, for example, graphics and other display devices to be
>included in the document.
>
>Therefore in my opinion, this should not be allowed. What do other people
>think?
>
>David
>> mailto:<[email-masked]>
>> Mondex International, US Advanced Technology Office
>> 111 Pine St, 6th Floor, San Francisco, CA 94111
>> Tel/Voicemail: +1 415 645 6973	Fax: +1 415 956 9370
>> 
>
>****************************************************************************
>******************
>
>This Email and any attached files are confidential and may also be
privileged. 
>If you are not the intended recipient, please notify the postmaster using 
>email 
>address [email-masked] or call +44 171 557 5000 and ask for the 
>IT Helpdesk.  You should not copy this email and any attached files, use them 
>for any purpose or disclose the contents to any other person; all copies of 
>the 
>Email and associated files in your possession should be destroyed.
>
>Mondex International Limited
>47-53 Cannon Street
>London EC4M 5SQ
>United Kingdom
>Registered No: 3122085, England
>
>Phone:          +44 171 557 5000
>Fax:            +44 171 557 5200
>Email:          [email-masked]
>WebSite:        http://www.mondexinternational.com
>
>****************************************************************************
>*****************
>-----------------------------------------------------------------------
>Message addressed to: [email-masked]
>Archive available at: http://www.elistx.com/archives/ietf-trade/
>To (un)subscribe send a message with "subscribe" or "unsubscribe" in the
>body to: [email-masked]

-----------------------------------------------------------------------
Message addressed to: [email-masked]
Archive available at: http://www.elistx.com/archives/ietf-trade/
To (un)subscribe send a message with "subscribe" or "unsubscribe" in the
body to: [email-masked]

---

From: David Burdett <[email-masked]>
Date: Thu, 29 Apr 1999 17:17:04 +0100

I think I better add some clarification on this topic.

Initially, the IOTP specs said that order descriptions, payment notes, etc,
should be simple "plain text" to ensure interoperability and help avoid the
problems that Hannu, Donn and Eric have described. It was then realised that
both pilot implementations based on the v 0.9 spec used HTML and/or XML and
not "plain text".

Conclusion: People don't want to use plain text therefore we better include
a method of handling HTML or XML in the specification. If we don't then
people will use HTML/XML anyway and pretty well all implementations will be
non-conformant !!

Exactly what the specification currently says is attached below but
essentially it is designed to avoid the problems that have been raised.
Don's comment was the sentence at the end of the second bullet point which
says:

	"... the "Main" Packaged Content element must not be referred to
from the HTML in any other Packaged Content"

The general idea is that packaged HTML should really appear to the user as a
simple single or multi page document, much like users would receive in the
real world, where *everything* required to generate the document is included
as packaged content in the Order Description. It therefore doesn't really
make sense, in my view, to be able to follow a link that takes you to the
"Main" packaged content from elsewhere.

On the other hand you don't want to ban links entirely for example you might
want to include in the HTML buttons which say "click here for customer care"
which could take you to a web page where you could report problems. This
could make sense. However another a link which dynamically downloaded over
the web a GIF of your order description would not since the GIF could be
changed after the event. IMOH though I don't think this type of behaviour by
merchants will be particularly widespread. Thoughts anyone on this topic?

David

======= Extract from the v 03 spec ========
  3.8.1 Packaging HTML

  The packaged content may contain HTML. In this case the following
  conventions are followed:

  o references to any documents, images or other things, such as
    sounds or web pages, which can affect the recipient's
    understanding of the data which is being packaged must refer to
    other Packaged Elements contained within the same parent
    element, e.g. an Order Description

  o if more than one Packaged Content element is included within a
    parent element in order to meet the previous requirement, then
    the Name attribute of the top level Packaged Content from which
    references to all other Packaged Elements can be determined,
    should have a value of Main. This means that the "Main"
    Packaged Content element must not be referred to from the HTML
    in any other Packaged Content

  o relative references to other documents, images, etc. from one
    Packaged Content element to another are realised by setting the
    value of the relative reference to the Name attribute of
    another Packaged Content element at the same level and within
    the same parent element

  o no external references that require the reference to be
    resolved immediately should be used. As this could make the
    HTML difficult or impossible to display completely

  o [MIME] is used to encapsulate the data inside each Packaged
    Element. This means that the information in the MIME header
    used to identify the type of data which has been encapsulated
    and therefore how it should be displayed.

  If the above conventions are not followed by, for example, including
  external references which must be resolved, then the recipient of the
  HTML should be informed.

  [Note]   As an implementation guideline the values of the Name
           Attributes allocated to Packaged Content elements should
           make it possible to extract each Packaged Content into a
           directory and then display the HTML directly
  [Note End]             

> ----------
> From: 	Hannu Nikkanen[SMTP:[email-masked]]
> Sent: 	29 April 1999 01:05
> To: 	Ietf Trade WG
> Subject: 	Re: Links in HTML data
> 
> Hi,
> 

**********************************************************************************************

This Email and any attached files are confidential and may also be privileged. 
If you are not the intended recipient, please notify the postmaster using email 
address [email-masked] or call +44 171 557 5000 and ask for the 
IT Helpdesk.  You should not copy this email and any attached files, use them 
for any purpose or disclose the contents to any other person; all copies of the 
Email and associated files in your possession should be destroyed.

Phone:          +44 171 557 5000
Fax:            +44 171 557 5200

*********************************************************************************************