Subject: Re: Links in HTML data

From: "Donald E. Eastlake 3rd" <[email-masked]>
Date: Wed, 05 May 1999 08:18:00 -0400

This whole area seems to be more painful that you would think at
first.

My comment was because there seemed to me to be no problem with
circular links, etc., as long as everything pointed to was included.
Thus, if the Main page points to pages A and B, I don't see it as a
problem, as long as Main, A, & B are all included in the message, if
page A links to page B and/or page B links to page A and/or either A
or B link to Main.  Mainy web sites have a "return to mail page
button" and as long as both the subsidiary and main pages are included
in the probably signed message, what is the problem?

Part of the reason for allowing links was so that images and sounds,
etc., could be included as long as the data is also in the message and
so can't be changed.  As long as the message is self contained and
there is an appropriate user interface, this seems like an
advantage. At least, as David point out below, people are likely to do
it no matter what we say :-)

Anyway, I continue to believe there is no problem with pointers in
subsidiary HTML pages that are included in the message having links
back to the main page.

Thanks,
Donald

From:  David Burdett <[email-masked]>
Message-Id:  <[email-masked]>
To:  Ietf Trade WG <[email-masked]>
Date:  Thu, 29 Apr 1999 17:17:04 +0100

>I think I better add some clarification on this topic.
>
>Initially, the IOTP specs said that order descriptions, payment notes, etc,
>should be simple "plain text" to ensure interoperability and help avoid the
>problems that Hannu, Donn and Eric have described. It was then realised that
>both pilot implementations based on the v 0.9 spec used HTML and/or XML and
>not "plain text".
>
>Conclusion: People don't want to use plain text therefore we better include
>a method of handling HTML or XML in the specification. If we don't then
>people will use HTML/XML anyway and pretty well all implementations will be
>non-conformant !!
>
>Exactly what the specification currently says is attached below but
>essentially it is designed to avoid the problems that have been raised.
>Don's comment was the sentence at the end of the second bullet point which
>says:
>
>	"... the "Main" Packaged Content element must not be referred to
>from the HTML in any other Packaged Content"
>
>The general idea is that packaged HTML should really appear to the user as a
>simple single or multi page document, much like users would receive in the
>real world, where *everything* required to generate the document is included
>as packaged content in the Order Description. It therefore doesn't really
>make sense, in my view, to be able to follow a link that takes you to the
>"Main" packaged content from elsewhere.
>
>On the other hand you don't want to ban links entirely for example you might
>want to include in the HTML buttons which say "click here for customer care"
>which could take you to a web page where you could report problems. This
>could make sense. However another a link which dynamically downloaded over
>the web a GIF of your order description would not since the GIF could be
>changed after the event. IMOH though I don't think this type of behaviour by
>merchants will be particularly widespread. Thoughts anyone on this topic?
>
>David
>
>======= Extract from the v 03 spec ========
>  3.8.1 Packaging HTML
>
>  The packaged content may contain HTML. In this case the following
>  conventions are followed:
>
>  o references to any documents, images or other things, such as
>    sounds or web pages, which can affect the recipient's
>    understanding of the data which is being packaged must refer to
>    other Packaged Elements contained within the same parent
>    element, e.g. an Order Description
>
>  o if more than one Packaged Content element is included within a
>    parent element in order to meet the previous requirement, then
>    the Name attribute of the top level Packaged Content from which
>    references to all other Packaged Elements can be determined,
>    should have a value of Main. This means that the "Main"
>    Packaged Content element must not be referred to from the HTML
>    in any other Packaged Content
>
>  o relative references to other documents, images, etc. from one
>    Packaged Content element to another are realised by setting the
>    value of the relative reference to the Name attribute of
>    another Packaged Content element at the same level and within
>    the same parent element
>
>  o no external references that require the reference to be
>    resolved immediately should be used. As this could make the
>    HTML difficult or impossible to display completely
>
>  o [MIME] is used to encapsulate the data inside each Packaged
>    Element. This means that the information in the MIME header
>    used to identify the type of data which has been encapsulated
>    and therefore how it should be displayed.
>
>  If the above conventions are not followed by, for example, including
>  external references which must be resolved, then the recipient of the
>  HTML should be informed.
>
>  [Note]   As an implementation guideline the values of the Name
>           Attributes allocated to Packaged Content elements should
>           make it possible to extract each Packaged Content into a
>           directory and then display the HTML directly
>  [Note End]             
>
>
>> ----------
>> From: 	Hannu Nikkanen[SMTP:[email-masked]]
>> Sent: 	29 April 1999 01:05
>> To: 	Ietf Trade WG
>> Subject: 	Re: Links in HTML data
>> 
>> Hi,
>> 
>> I believe that "what you see is what you sign" would be a better approach.
>> 
>> In principle, graphics could be used to insert logos of other companies or
>> some text, which the signer could not distinguish from the signed part.
>> 
>> Even if the risk is low, it may lower consumer trust, which probably is
>> one
>> of the main commercial goals. 
>> 
>> Hannu
>> 
>> At 22:45 28.4.1999 +0100, you wrote:
>> >Don Eastlake says in his email:
>> >
>> >	"Section 3.8.1: I don't understand why sub-pages of an HTML main
>> >page couldn't have links back to the main page."
>> >
>> >In IOTP, where HTML is being used to describe a document such as an order
>> >description or a payment note, then it is, in many ways being provided as
>> an
>> >alternative to a single, or multi-page "real world" document. These
>> >documents should not in general be :"multi-media" documents, since for
>> >purposes of non-refutability, the document should be self-contained and
>> not
>> >reliant on other records held elsewhere. For this reason links should
>> only
>> >be used to allow, for example, graphics and other display devices to be
>> >included in the document.
>> >
>> >Therefore in my opinion, this should not be allowed. What do other people
>> >think?
>> >
>> >David
>> >> mailto:<[email-masked]>
>> >> Mondex International, US Advanced Technology Office
>> >> 111 Pine St, 6th Floor, San Francisco, CA 94111
>> >> Tel/Voicemail: +1 415 645 6973	Fax: +1 415 956 9370
-----------------------------------------------------------------------
Message addressed to: [email-masked]
Archive available at: http://www.elistx.com/archives/ietf-trade/
To (un)subscribe send a message with "subscribe" or "unsubscribe" in the
body to: [email-masked]

---

From: David Burdett <[email-masked]>
Date: Tue, 18 May 1999 02:16:59 +0100

OK ... Don's convinced me ! You can point back to the "Main" page. After all
we can't completely control what people do anyway.

David

> ----------
> From: 	Donald E. Eastlake 3rd[SMTP:[email-masked]]
> Sent: 	05 May 1999 05:18
> To: 	Ietf Trade WG

**********************************************************************************************

This Email and any attached files are confidential and may also be privileged. 
If you are not the intended recipient, please notify the postmaster using email 
address [email-masked] or call +44 171 557 5000 and ask for the 
IT Helpdesk.  You should not copy this email and any attached files, use them 
for any purpose or disclose the contents to any other person; all copies of the 
Email and associated files in your possession should be destroyed.

Mondex International Limited
47-53 Cannon Street
London EC4M 5SQ
United Kingdom
Registered No: 3122085, England

Phone:          +44 171 557 5000
Fax:            +44 171 557 5200
Email:          [email-masked]
WebSite:        http://www.mondexinternational.com

*********************************************************************************************