Subject: [Uri-review] New URI scheme for review

From: Bob Van Zant <[email-masked]>
Date: Mon, 10 Oct 2011 16:30:52 -0700

It looks like most URI schemes like this one are never registered with
IANA. It seems like The Right Thing to do and so I present to the list
the URI scheme com-eventbrite-attendee.

URI scheme name.
    com-eventbrite-attendee

Status.
    provisional

URI scheme syntax.
    uri = "com-eventbrite-attendee:" method [ "?" query ]
    method = "resetpassword" / "tickets"

    Example:

        com-eventbrite-attendee:resetpassword?email=user%40domain.com&token=DEADBEEF

URI scheme semantics.
    This scheme is intended to be used by operating systems that have the
    Eventbrite Attendee application installed. When a URI with
    this scheme is encountered it is expected that the operating system
    launches the Eventbrite Attendee application with the method and
    query parameters specified in the URI.

    The exact semantics for how URL information is communicated to the
    Eventbrite Attendee app may vary on an operating system basis. The
    expectation is simply that the operating system follows its own
    conventions for passing the method and query parameters into the
    application.

Encoding considerations.
    The scheme and method portions of this proposed URI avoid encoding
    issues by limiting itself to a subset of ASCII.

    The query portion of a com-eventbrite-attendee URI shall be encoded
    according to the rules in RFC 3986.

Applications/protocols that use this URI scheme name.

    - Eventbrite Attendee for iOS
    - Eventbrite Attendee for Android

Interoperability considerations.
    none.

Security considerations.
    Against recommendations in RFC 3986 section 7.5 a
    com-eventbrite-attendee: URI may be used to transmit sensitive
    information. For example, it may be used to communicate a password
    reset token in email for a user following a "Forgot your password"
    flow. Though this token may have transmitted over insecure channels
    on its way to the application care must still be taken by
    application developers to not divulge this secret.

    RFC 3986 sections 7.2 and 7.5 apply

Contact.
    Bob Van Zant
    Eventbrite
    651 Brannan St
    San Francisco, CA 94103
    USA

    EMail: [email-masked]

Author/Change controller.
    Bob Van Zant

References.

    Berners-Lee, T., Fielding, R., and L. Masinter, "Uniform
    Resource Identifier (URI): Generic Syntax", STD 66, RFC 3986,
    January 2005.

---

From: Frank Ellermann <[email-masked]>
Date: Tue, 11 Oct 2011 08:00:09 +0200

On 11 October 2011 01:30, Bob Van Zant <[email-masked]> wrote:

> It looks like most URI schemes like this one are never registered
> with IANA. It seems like The Right Thing to do and so I present to
> the list the URI scheme com-eventbrite-attendee.

Yeah.  I'd be tempted to reject it as "vanity URI scheme in conflict
with RFC 4395 2.1 Demonstratable, New, Long-Lived Utility", but that
might be not "the right thing", and besides only the expert reviewer
(= not me) could say so.

Disclaimer, I have not yet read the 4395bis drafts, maybe 4395bis
will drop the "long-lived utility" blurb in favour of a new "above
all let's have it registered" approach.

With that out of the way, are you sure that you want an OPTIONAL
query part in the syntax?  If the query part is actually REQUIRED

>    method = "resetpassword" / "tickets"

If you happen to have a web page with more technical details please
add it to the references.  If that is not (yet) the case it is no
problem, your explanation in the registration template is clear.

-Frank

---

From: Bob Van Zant <[email-masked]>
Date: Tue, 11 Oct 2011 12:35:08 -0700

> might be not "the right thing", and besides only the expert reviewer

The same thoughts went through my head. But then I wondered why the
authors bothered to invent the com-domain-descriptor syntax. Though, I
think we have demonstrable, new and long lived utility. It just so
happens that it really only applies to our application and URIs that
our website generate as part of communication to our customers. I
could see some utility of this being registered so that application
developers of, for example, mail gateway software and in particular
anti-{spam,malware} software, would be aware of our scheme and not
immediately assume something malicious or nefarious.

> all let's have it registered" approach.

Nope, it still has its own section (3.1).

http://tools.ietf.org/html/draft-ietf-iri-4395bis-irireg-03

>>    method = "resetpassword" / "tickets"

The optional was intentional. The "tickets" method, for example,
doesn't require any parameters. It simply means open up the app and
bring me to the tickets screen. Along these lines we're requesting
provisional status because we assume that we will add new methods in
the near future; though we do not know what they are just yet.

Thanks for the feedback.

-Bob

---

From: Mark Baker <[email-masked]>
Date: Tue, 11 Oct 2011 15:55:51 -0400

> Nope, it still has its own section (3.1).

Right, but that only applies to permanent registration. I think
provisional was the right choice here for these
lets-just-get-it-registered reasons.

Mark.

---

From: Frank Ellermann <[email-masked]>
Date: Wed, 12 Oct 2011 22:42:42 +0200

On 11 October 2011 21:35, Bob Van Zant wrote:

> I could see some utility of this being registered so that application

Okay.  And if that results in dozens of appname-exec:something?query
schemes somebody can suggest a general exec:appname/something?query
scheme (or similar.)  So far the URI scheme registry does not suffer
from too many registrations.

Thanks for your <URL:com-eventbrite-attendee:tickets> explanation,
 Frank

---

From: "Martin J. Dürst" <[email-masked]>
Date: Thu, 13 Oct 2011 10:09:05 +0900

On 2011/10/13 5:42, Frank Ellermann wrote:
> scheme (or similar.)

Yes indeed. exec: would be quite general. Something more specific such 
as iphone-app-startup: would also work; it shouldn't be too difficult to 
create an application that starts up with that URI and then looks at the 
rest and starts up another application. Of course, that doesn't solve 
the problem that these links don't work outside iphone and friends, but 
it would remove the problem of thousands of non-registered schemes, or 
push the registration problem a level lower.

Regards,    Martin.

> So far the URI scheme registry does not suffer
> Thanks for your<URL:com-eventbrite-attendee:tickets>  explanation,
>   Frank
> _______________________________________________
> Uri-review mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/uri-review
>

---

From: Bob Van Zant <[email-masked]>
Date: Tue, 18 Oct 2011 10:50:02 -0700

It appears that the feedback on this proposal has quieted and I don't
have any pending changes to make. What is the next step?

On Wed, Oct 12, 2011 at 6:09 PM, "Martin J. Dürst"
<[email-masked]> wrote:
> Yes indeed. exec: would be quite general. Something more specific such as
> iphone-app-startup: would also work; it shouldn't be too difficult to create
> an application that starts up with that URI and then looks at the rest and
> starts up another application. Of course, that doesn't solve the problem
> that these links don't work outside iphone and friends, but it would remove
> the problem of thousands of non-registered schemes, or push the registration
> problem a level lower.
>
> Regards,    Martin.
>

---

From: Frank Ellermann <[email-masked]>
Date: Wed, 19 Oct 2011 12:44:00 +0200

> have any pending changes to make. What is the next step?

Hi, go to the IANA page "other registrations" (or similar), fill out
their Web form: one part is the template as posted here, in another
field you state the registry URL for URI schemes, in a third field
you state the relevant RFC 4395, in the spare unclear field add a
pointer to this thread, and they also want your e-mail address for
a success message or questions.

-Frank

---

From: Graham Klyne <[email-masked]>
Date: Wed, 19 Oct 2011 14:36:53 +0100

On 11/10/2011 07:00, Frank Ellermann wrote:
> On 11 October 2011 01:30, Bob Van Zant<[email-masked]>  wrote:
>

As a reviewer, that's not how I see the review process.  It's not one reviewer 
making a quality judgement, but checking that the stated requirements for 
registration have been met.

 From what I've seen, I'd say there's at least enough information here to 
justify a provisional registration.  For permanent registration, I'd be looking 
for evidence of community consensus that this is useful and well-conceived and 
has long-lived value.  I don't think "vanity" per se is a consideration or concern.

...

Speaking for myself, this does indeed look like a case that is not easily 
satisfied by existing URI schemes.  I had some thoughts along the lines of the 
"exec" scheme mentioned later in this thread, but I'm not sure either way: 
essentially, in the tradition of handling comp sci problems, it's another level 
of indirection, and I don't know if there would be enough new URI schemes like 
this to justify that new level.

Maybe there's scope for a URI scheme for encoding "web intent" style handoff? 
(http://webintents.org/)

For a proprietary application that does not claim to interoperate with others I 
think the name form chosen is very appropriate - later maybe we'll even see more 
open interoperability in this event space using a more generic name-form?

#g
--

---

From: Mykyta Yevstifeyev <[email-masked]>
Date: Sat, 22 Oct 2011 07:48:35 +0300

Bob,

The IRI WG has reached the consensus to remove the statement you were 
guided by in the 4395bis.  It hasn't been the current practice, I and I 
don't recommend you to proceed with the registration.

Thanks,
Mykyta Yevstifeyev

---

From: "Martin J. Dürst" <[email-masked]>
Date: Sun, 23 Oct 2011 07:02:24 +0900

Hello Mykyta,

On 2011/10/22 13:48, Mykyta Yevstifeyev wrote:
> guided by in the 4395bis.

Can you say which statement you are referring to?

Regards,   Martin.

> It hasn't been the current practice, I and I

---

From: Mykyta Yevstifeyev <[email-masked]>
Date: Mon, 24 Oct 2011 07:47:55 +0300

> Can you say which statement you are referring to?

See http://trac.tools.ietf.org/wg/iri/trac/ticket/73; that's

>     Organizations that desire a private name space for URI scheme names
>     are encouraged to use a prefix based on their domain name, expressed
>     in reverse order.  For example, a URI scheme name of com-example-info
>     might be registered by the vendor that owns the example.com domain
>     name.

Mykyta

---

From: Bob Van Zant <[email-masked]>
Date: Sun, 23 Oct 2011 22:32:00 -0700

In that discussion the working group appears to be agreeing that
there's no reason to ask organizations to register structured names
like com-eventbrite-attendee. It does not appear to suggest that
organizations should not register their schemes.

In any case I submitted our registration request to IANA before this occurred.

---

From: Mykyta Yevstifeyev <[email-masked]>
Date: Mon, 24 Oct 2011 12:25:35 +0300

> organizations should not register their schemes.

Have you been using this name so far?  Mykyta

> On Sun, Oct 23, 2011 at 9:47 PM, Mykyta Yevstifeyev<[email-masked]>  wrote:

---

From: Bob Van Zant <[email-masked]>
Date: Mon, 24 Oct 2011 08:36:23 -0700

In development, yes.

---

From: Frank Ellermann <[email-masked]>
Date: Tue, 25 Oct 2011 07:21:23 +0200

> IANA before this occurred.

Maybe 4395bis should pick two instead of four weeks
for reviews.  It works on another list with the same
expert.  IANA or expert can always bounce a request
if they feel that it needs more tuning, but generally
your intuitive approach (silence => submit) should be
good enough.

-Frank

---

From: "Martin J. Dürst" <[email-masked]>
Date: Tue, 25 Oct 2011 15:26:39 +0900

I made this a ticket at 
http://trac.tools.ietf.org/wg/iri/trac/ticket/100. Please continue 
discussion of general registration issues on the IETF WG IRI list, 
[email-masked].

Regards,    Martin.