Subject: Fwd: W3C/IETF coordination call 13 March, HTML 5 get-together ~25 March
From: Mark Nottingham <[email-masked]>
To: W3C/IETF <[email-masked]>
Date: Tue, 3 Mar 2009 07:37:31 +1100
List-Id: Discussion of w3c-ietf policy issues <w3c-policy.ietf.org>

AIUI we're not in the habit of publicising our agenda or pre- 
announcing calls on the public list; from my archives, only minutes go  
there.

I'm happy to change this practice, but it seems like we should have a  
discussion of it first.

Thoughts?

Begin forwarded message:

> From: Arthur Barstow <[email-masked]>
> Date: 3 March 2009 3:31:03 AM
> To: ext Dan Connolly <[email-masked]>, Mark Nottingham  
> <[email-masked]>
> Cc: public-ietf-w3c <[email-masked]>
> Subject: Re: W3C/IETF coordination call 13 March, HTML 5 get- 
> together ~25 March
>
> Dan, Mark - where is the agenda for this call? -Thanks, Art Barstow
>
> On Feb 24, 2009, at 1:20 PM, ext Dan Connolly wrote:
>
>> FYI... The next W3C/IETF liaison teleconference is scheduled
>> for 13 March. Mark Nottingham is chairing this time.
>>  http://esw.w3.org/topic/IetfW3cLiaison
>>
>> I chaired the previous one:
>> http://lists.w3.org/Archives/Public/public-ietf-w3c/2009Jan/0003.html
>>
>> And supplementary to IETF 75 near SFO an HTML 5 related get-together
>> is brewing.
>> http://esw.w3.org/topic/IETF_HTML5_Meeting_March_2009
>>

--
Mark Nottingham     http://www.mnot.net/

Date: Mon, 02 Mar 2009 20:16:31 -0600
From: Dan Connolly <[email-masked]>
To: Mark Nottingham <[email-masked]>
Subject: Re: Fwd: W3C/IETF coordination call 13 March,	HTML 5 get-together ~25 March
Cc: W3C/IETF <[email-masked]>

Mark Nottingham wrote:
> AIUI we're not in the habit of publicising our agenda or pre-announcing 
> calls on the public list; from my archives, only minutes go there.

Right... I'm happy to tell Art that we take agenda input from
public-ietf-w3c but we don't typically publish the agenda ahead of time.

> I'm happy to change this practice, but it seems like we should have a 
> discussion of it first.

Oops; I guess I jumped the gun a little.

I thought I saw the date in the (public) ESW wiki was that before
or after I sent my message... ok... right... before.

> 
> Thoughts?
> 
> 
> Begin forwarded message:
> 
>> From: Arthur Barstow <[email-masked]>
>> Date: 3 March 2009 3:31:03 AM
>> To: ext Dan Connolly <[email-masked]>, Mark Nottingham <[email-masked]>
>> Cc: public-ietf-w3c <[email-masked]>
>> Subject: Re: W3C/IETF coordination call 13 March, HTML 5 get-together 
>> ~25 March
>>
>> Dan, Mark - where is the agenda for this call? -Thanks, Art Barstow
>>
>> On Feb 24, 2009, at 1:20 PM, ext Dan Connolly wrote:
>>
>>> FYI... The next W3C/IETF liaison teleconference is scheduled
>>> for 13 March. Mark Nottingham is chairing this time.
>>>  http://esw.w3.org/topic/IetfW3cLiaison
>>>
>>> I chaired the previous one:
>>> http://lists.w3.org/Archives/Public/public-ietf-w3c/2009Jan/0003.html
>>>
>>> And supplementary to IETF 75 near SFO an HTML 5 related get-together
>>> is brewing.
>>> http://esw.w3.org/topic/IETF_HTML5_Meeting_March_2009
>>>
> 
> 
> -- 
> Mark Nottingham     http://www.mnot.net/

-- 
Dan Connolly, W3C http://www.w3.org/People/Connolly/

From [email-masked]  Tue Mar  3 18:23:28 2009
From: Mark Nottingham <[email-masked]>
To: W3C/IETF <[email-masked]>
Subject: Re: Next call: March 13 1pm US/Pacific (updated agenda)
Date: Wed, 4 Mar 2009 13:23:49 +1100
Cc: fd <[email-masked]>

On 26/02/2009, at 12:50 PM, Mark Nottingham wrote:

Agenda:
0) select scribe
1) review action items
    DONE: mnot to draft wiki page on IETF/W3C liaison
    ACTION: mnot to propose times for 3/13, 5/14, 7/16 liaison calls
    ACTION: plh to contact MDW about liaison response to IETF
    DONE: plh to inform Arun of March 2 deadline, encourage quick I-D =20=

submission for Origin proposal
2) GeoPriv liaison statement response
3) Quick list of new work at IETF74 -- MMOX, OAUTH bofs in particular =20=

[Lisa]
4) IETF/HTML5 meeting =
<http://esw.w3.org/topic/IETF_HTML5_Meeting_March_2009=20
 > [Sam]
5) VOICEXML use of POST =
<http://tools.ietf.org/html/draft-ietf-mediactrl-vxml-04=20
 > [Lisa / Francois Daoust]
6) draft-abarth-origin =
<http://ietfreport.isoc.org/idref/draft-abarth-origin/=20
 >
7) draft-abarth-mime-sniff =
<http://ietfreport.isoc.org/idref/draft-abarth-mime-sniff/=20
 >
8) draft-hixie-thewebsocketprotocol =
<http://ietfreport.isoc.org/idref/draft-hixie-thewebsocketprotocol/=20
 >

Call details:
Friday, 13 March 17:00-18:00 UTC  (1:00pm-2:00pm Boston local)
=
<http://www.timeanddate.com/worldclock/fixedtime.html?month=3D03&day=3D13&=
year=3D2009&hour=3D17&min=3D00&sec=3D0&p1=3D0=20
 >
Zakim Bridge +1.617.761.6200 <tel:+1.617.761.6200>, conference 4383 =20
(=93IETF=94)
10 participants
IRC: irc.w3.org, port 6665  #ietf

Expected:
  Lisa, Mark, Philippe, DanC, John, Francois Daoust, Sam Ruby
Regrets:
  TimBL

--
Mark Nottingham     http://www.mnot.net/=

From [email-masked]  Wed Mar  4 11:43:44 2009
Subject: Re: Next call: March 13 1pm US/Pacific (updated agenda)
From: Philippe Le Hegaret <[email-masked]>
To: Mark Nottingham <[email-masked]>
Organization: World Wide Web Consortium
Date: Wed, 04 Mar 2009 14:44:11 -0500
Cc: fd <[email-masked]>, Matt Womer <[email-masked]>, W3C/IETF <[email-masked]>

Some corrections.

On Wed, 2009-03-04 at 13:23 +1100, Mark Nottingham wrote:
> On 26/02/2009, at 12:50 PM, Mark Nottingham wrote:
> 
> Agenda:
> 0) select scribe
> 1) review action items
>     DONE: mnot to draft wiki page on IETF/W3C liaison
>     ACTION: mnot to propose times for 3/13, 5/14, 7/16 liaison calls
>     ACTION: plh to contact MDW about liaison response to IETF
>     DONE: plh to inform Arun of March 2 deadline, encourage quick I-D  
> submission for Origin proposal
> 2) GeoPriv liaison statement response

I invited Matt Womer as well to join us. Matt worked with the Chairs of
the geolocation group to find out what happened there. Matt and I did
the forensic analysis and I expect to have an official response from W3C
before the call btw.

> 3) Quick list of new work at IETF74 -- MMOX, OAUTH bofs in particular  
> [Lisa]
> 4) IETF/HTML5 meeting <http://esw.w3.org/topic/IETF_HTML5_Meeting_March_2009 
>  > [Sam]
> 5) VOICEXML use of POST <http://tools.ietf.org/html/draft-ietf-mediactrl-vxml-04 
>  > [Lisa / Francois Daoust]

Not sure why Francois's name appears here. Francois will join us for the
HTTP header fields X-* discussion, which doesn't seem to be scheduled
however. Since Francois will join us from France, is it possible to put
his discussion earlier in the agenda?

Regarding vxml, do you have a pointer for the discussion abour the vxml
issue so I can try to get prepared for it?

> 6) draft-abarth-origin <http://ietfreport.isoc.org/idref/draft-abarth-origin/ 
>  >
> 7) draft-abarth-mime-sniff <http://ietfreport.isoc.org/idref/draft-abarth-mime-sniff/ 
>  >
> 8) draft-hixie-thewebsocketprotocol <http://ietfreport.isoc.org/idref/draft-hixie-thewebsocketprotocol/ 
>  >

Philippe

From [email-masked]  Thu Mar  5 00:59:34 2009
From: Mark Nottingham <[email-masked]>
To: Philippe Le Hegaret <[email-masked]>
Subject: Re: Next call: March 13 1pm US/Pacific (updated agenda)
Date: Thu, 5 Mar 2009 19:59:52 +1100
Cc: fd <[email-masked]>, Matt Womer <[email-masked]>, W3C/IETF <[email-masked]>

Thanks, Philippe. I'll send out a revised agenda in a moment.

Regarding vxml - Lisa had some questions about an I-D and VoiceXML's  
use of POST; see <https://datatracker.ietf.org/idtracker/draft-ietf-mediactrl-vxml/comment/92177/ 
 >.

Cheers,

On 05/03/2009, at 6:44 AM, Philippe Le Hegaret wrote:

> Some corrections.
>
> On Wed, 2009-03-04 at 13:23 +1100, Mark Nottingham wrote:
>> On 26/02/2009, at 12:50 PM, Mark Nottingham wrote:
>>
>> Agenda:
>> 0) select scribe
>> 1) review action items
>>    DONE: mnot to draft wiki page on IETF/W3C liaison
>>    ACTION: mnot to propose times for 3/13, 5/14, 7/16 liaison calls
>>    ACTION: plh to contact MDW about liaison response to IETF
>>    DONE: plh to inform Arun of March 2 deadline, encourage quick I-D
>> submission for Origin proposal
>> 2) GeoPriv liaison statement response
>
> I invited Matt Womer as well to join us. Matt worked with the Chairs  
> of
> the geolocation group to find out what happened there. Matt and I did
> the forensic analysis and I expect to have an official response from  
> W3C
> before the call btw.
>
>> 3) Quick list of new work at IETF74 -- MMOX, OAUTH bofs in particular
>> [Lisa]
>> 4) IETF/HTML5 meeting <http://esw.w3.org/topic/IETF_HTML5_Meeting_March_2009
>>> [Sam]
>> 5) VOICEXML use of POST <http://tools.ietf.org/html/draft-ietf-mediactrl-vxml-04
>>> [Lisa / Francois Daoust]
>
> Not sure why Francois's name appears here. Francois will join us for  
> the
> HTTP header fields X-* discussion, which doesn't seem to be scheduled
> however. Since Francois will join us from France, is it possible to  
> put
> his discussion earlier in the agenda?
>
> Regarding vxml, do you have a pointer for the discussion abour the  
> vxml
> issue so I can try to get prepared for it?
>
>> 6) draft-abarth-origin <http://ietfreport.isoc.org/idref/draft-abarth-origin/
>>>
>> 7) draft-abarth-mime-sniff <http://ietfreport.isoc.org/idref/draft-abarth-mime-sniff/
>>>
>> 8) draft-hixie-thewebsocketprotocol <http://ietfreport.isoc.org/idref/draft-hixie-thewebsocketprotocol/
>>>
>
> Philippe
>
>

--
Mark Nottingham     http://www.mnot.net/

From [email-masked]  Thu Mar  5 01:01:26 2009
From: Mark Nottingham <[email-masked]>
To: W3C/IETF <[email-masked]>
Subject: Re: Next call: March 13 1pm US/Pacific (updated agenda)
Date: Thu, 5 Mar 2009 20:01:49 +1100
Cc: fd <[email-masked]>, Matt Womer <[email-masked]>

Agenda:
  0) select scribe
  1) review action items
   DONE: mnot to draft wiki page on IETF/W3C liaison
   ACTION: mnot to propose times for 3/13 [DONE], 5/14, 7/16 liaison =20
calls
   DONE: plh to contact MDW about liaison response to IETF
   DONE: plh to inform Arun of March 2 deadline, encourage quick I-D =20
submission for Origin proposal
  2) W3C Content Transformation Proxies guidelines [Francois Daoust]
     <http://www.w3.org/mid/000001c97cd0$f6bd1b40$7a9eca3e@AREPPIM002>
  3) Review wiki page <http://esw.w3.org/topic/IetfW3cLiaison>
  4) GeoPriv liaison statement response [Matt Womer]
    <https://datatracker.ietf.org/liaison/486/>
  5) Quick list of new work at IETF74 -- MMOX, OAUTH bofs in =20
particular [Lisa]
    <http://www.ietf.org/meetings/74/>
  6) IETF/HTML5 meeting  [Sam]
    <http://esw.w3.org/topic/IETF_HTML5_Meeting_March_2009>
  7) VOICEXML use of POST [Lisa]
   <https://datatracker.ietf.org/idtracker/draft-ietf-mediactrl-vxml/>
  8) draft-abarth-origin =
<http://ietfreport.isoc.org/idref/draft-abarth-origin/=20
 >
  9) draft-abarth-mime-sniff =
<http://ietfreport.isoc.org/idref/draft-abarth-mime-sniff/=20
 >
10) draft-hixie-thewebsocketprotocol =
<http://ietfreport.isoc.org/idref/draft-hixie-thewebsocketprotocol/=20
 >

Call details:
Friday, 13 March 17:00-18:00 UTC  (1:00pm-2:00pm Boston local)
=
<http://www.timeanddate.com/worldclock/fixedtime.html?month=3D03&day=3D13&=
year=3D2009&hour=3D17&min=3D00&sec=3D0&p1=3D0=20
 >
Zakim Bridge +1.617.761.6200 <tel:+1.617.761.6200>, conference 4383 =20
(=93IETF=94)
10 participants
IRC: irc.w3.org, port 6665  #ietf

Expected:
Lisa, Mark, Philippe, DanC, John, Francois Daoust, Sam Ruby, Matt Womer
Regrets:
TimBL

--
Mark Nottingham     http://www.mnot.net/=

From [email-masked]  Fri Mar 13 09:52:42 2009
Date: Fri, 13 Mar 2009 12:53:17 -0400
From: John C Klensin <[email-masked]>
To: Mark Nottingham <[email-masked]>, "W3C/IETF" <[email-masked]>
Subject: IDNs, IRIs, and URIs (again) (was: Re: Next call: March 13 1pm US/Pacific (updated agenda))
Cc: fd <[email-masked]>, Matt Womer <[email-masked]>

Hi.

This is far too late to get on today's agenda in any useful way
(and I wouldn't have time to prepare coherent comments if there
were) but, as a heads up...

The issue of the role of non-ASCII strings in URL/URI contexts
has arisen again in the IDNABIS WG in the context of transition
issues if non-ASCII UTF-8 strings (or the equivalent) are used
in URIs, either directly or in %-encoded form.  The issues have
arisen primarily in the context of the effort in the current
spec to reduce or eliminate the many mappings called for by
IDNA2003 (the current version).  That effort is motivated by the
increased fragility of the characters that are "mapped out" by
those mappings -- less likelihood of having accurate fonts
available, more likelihood of visual confusion, etc.  The
assumption that mappings will occur according to IDNA2003 rules
also turns some proposed changes to add characters into
incompatible ones (ones that some people consider incompatible
enough to represent security problems).

However, additional analysis demonstrates that there are
potential incompatibilities and transition-related changes even
if one simply moves from one version of Unicode to another with
no changes in the IDNA model.  For example, the IDNA2003 mapping
rules, especially if interpreted as "strings dependent on
mappings are ok in URIs" combine with Unicode 5.1's changes in
the model for coding Malayalam, make it impossible to make a
completely orderly transition between Unicode 3.2-based IDNA2003
and any version of IDNA based on Unicode 5.1 or later.

While I/we recognize that the use of UTF-8 strings in URLs
(possibly %-encoded) has become common and is supported in some
browsers and that HTML5 and XML efforts encourage the use of
IRIs in hrefs, those practices are problematic in several ways.
An over-dramatic way to describe the problem is that one has a
choice between those approaches and stable identifiers or
between stable identifiers and _ever_ moving off Unicode 3.2 for
IDNs.

It appears that one solution to the problems, which is not
within the scope of the IDNABIS WG (although it could make some
recommendations and assumptions) would be to:

	* Clarify that the only IDN forms permitted in URIs are
	the ACE-encoded forms (i.e., "A-labels" or "Punycode
	encoding with prefix") with no exceptions for %-encoded
	UTF-8 or other variations.
	
	* Clarify that IRI-> URI transformation of the domain
	name slot must produce ACE forms, not %-encoded UTF-8.
	
	* To the extent possible, encourage the use of URIs
	(with ACE-form labels only) in documents, especially
	documents that are expected to be long-lived, because
	mapping dependencies increase the odds that the
	identifiers will become unstable or ambiguous.
	
	* Specify the mappings that are permitted and/or
	required as IRI-> URI operations (map, then invoke IDNA
	to produce the ACE form from a UTF-8 form that does not
	require mapping) and do so on a per-protocol basis that
	might, e.g., do less mapping for some protocols than
	others and might treat domains appearing in the tail
	differently.
	
	* Put appropriate flexibility into the various
	web-related standards (especially XML and HTML) that
	permits the use of IRIs where URIs are already being
	used to include UTF-8 strings and handle the IRIs as
	suggested above.    

This is not a good solution.  In fact, it stinks.  But all of
the alternatives, notably ones that effectively leave us stuck
at Unicode 3.2, appear to be much worse.

Again, just a heads-up, although I expect that some of this will
come up strongly during IETF.

Talk with you all in a few minutes.

     john

From [email-masked]  Fri Mar 13 10:49:01 2009
From: Mark Nottingham <[email-masked]>
To: John C Klensin <[email-masked]>
Subject: Re: IDNs, IRIs, and URIs (again) (was: Re: Next call: March 13 1pm US/Pacific (updated agenda))
Date: Fri, 13 Mar 2009 10:49:36 -0700
Cc: fd <[email-masked]>, Matt Womer <[email-masked]>, W3C/IETF <[email-masked]>

Hi John,

Thanks; I'll make sure to put it on the agenda for next time.

In the meantime, I'm very interested in this topic, as I'm running up =20=

against a number of IRI-related issues in the Link draft.

As a side note I was amused and frustrated to run across an IRI in the =20=

wild on a US site yesterday;
   =
http://www.target.com/Thomas-Engine-Peel-Stick-Appliqu=E9s/dp/B000Q74WFG/
(notice the accent on Appliqu=E9s).

I cut-and-pasted it, and immediately noticed two problems;
   - Apple Mail's URI detection algorithms stopped at the accented =20
character
   - When pasted into Twitter, it was converted into a tinyURL;
   http://tinyurl.com/cw7hth
which resolves to
   http://www.target.com/Thomas-Engine-Peel-Stick-Appliqu=C3=A9s/dp/=20
B000Q74WFG/
which still works, I suspect, only because they're using the string =20
after 'dp' to find a row in a database.

IMO this does not bode well for IRIs as identifiers, since one of the =20=

big ideas that made URIs successful is the ability to cut and paste =20
them, write them down from billboards, etc.

Talk to you all at 1pm US/Pacific,

On 13/03/2009, at 9:53 AM, John C Klensin wrote:

> Hi.
>
> This is far too late to get on today's agenda in any useful way
> (and I wouldn't have time to prepare coherent comments if there
> were) but, as a heads up...
>
> The issue of the role of non-ASCII strings in URL/URI contexts
> has arisen again in the IDNABIS WG in the context of transition
> issues if non-ASCII UTF-8 strings (or the equivalent) are used
> in URIs, either directly or in %-encoded form.  The issues have
> arisen primarily in the context of the effort in the current
> spec to reduce or eliminate the many mappings called for by
> IDNA2003 (the current version).  That effort is motivated by the
> increased fragility of the characters that are "mapped out" by
> those mappings -- less likelihood of having accurate fonts
> available, more likelihood of visual confusion, etc.  The
> assumption that mappings will occur according to IDNA2003 rules
> also turns some proposed changes to add characters into
> incompatible ones (ones that some people consider incompatible
> enough to represent security problems).
>
> However, additional analysis demonstrates that there are
> potential incompatibilities and transition-related changes even
> if one simply moves from one version of Unicode to another with
> no changes in the IDNA model.  For example, the IDNA2003 mapping
> rules, especially if interpreted as "strings dependent on
> mappings are ok in URIs" combine with Unicode 5.1's changes in
> the model for coding Malayalam, make it impossible to make a
> completely orderly transition between Unicode 3.2-based IDNA2003
> and any version of IDNA based on Unicode 5.1 or later.
>
> While I/we recognize that the use of UTF-8 strings in URLs
> (possibly %-encoded) has become common and is supported in some
> browsers and that HTML5 and XML efforts encourage the use of
> IRIs in hrefs, those practices are problematic in several ways.
> An over-dramatic way to describe the problem is that one has a
> choice between those approaches and stable identifiers or
> between stable identifiers and _ever_ moving off Unicode 3.2 for
> IDNs.
>
> It appears that one solution to the problems, which is not
> within the scope of the IDNABIS WG (although it could make some
> recommendations and assumptions) would be to:
>
> 	* Clarify that the only IDN forms permitted in URIs are
> 	the ACE-encoded forms (i.e., "A-labels" or "Punycode
> 	encoding with prefix") with no exceptions for %-encoded
> 	UTF-8 or other variations.
> =09
> 	* Clarify that IRI-> URI transformation of the domain
> 	name slot must produce ACE forms, not %-encoded UTF-8.
> =09
> 	* To the extent possible, encourage the use of URIs
> 	(with ACE-form labels only) in documents, especially
> 	documents that are expected to be long-lived, because
> 	mapping dependencies increase the odds that the
> 	identifiers will become unstable or ambiguous.
> =09
> 	* Specify the mappings that are permitted and/or
> 	required as IRI-> URI operations (map, then invoke IDNA
> 	to produce the ACE form from a UTF-8 form that does not
> 	require mapping) and do so on a per-protocol basis that
> 	might, e.g., do less mapping for some protocols than
> 	others and might treat domains appearing in the tail
> 	differently.
> =09
> 	* Put appropriate flexibility into the various
> 	web-related standards (especially XML and HTML) that
> 	permits the use of IRIs where URIs are already being
> 	used to include UTF-8 strings and handle the IRIs as
> 	suggested above.
>
> This is not a good solution.  In fact, it stinks.  But all of
> the alternatives, notably ones that effectively leave us stuck
> at Unicode 3.2, appear to be much worse.
>
> Again, just a heads-up, although I expect that some of this will
> come up strongly during IETF.
>
> Talk with you all in a few minutes.
>
>     john
>

--
Mark Nottingham     http://www.mnot.net/

From [email-masked]  Fri Mar 13 10:54:26 2009
Date: Fri, 13 Mar 2009 13:55:03 -0400
From: Sam Ruby <[email-masked]>
To: Mark Nottingham <[email-masked]>
Subject: Re: IDNs, IRIs,	and URIs (again)
Cc: fd <[email-masked]>, Matt Womer <[email-masked]>, W3C/IETF <[email-masked]>, John C Klensin <[email-masked]>

Mark Nottingham wrote:
> 
> As a side note I was amused and frustrated to run across an IRI in the 
> wild on a US site yesterday;
>   http://www.target.com/Thomas-Engine-Peel-Stick-Appliqu�s/dp/B000Q74WFG/
> (notice the accent on Appliqu�s).
> 
> I cut-and-pasted it, and immediately noticed two problems;
>   - Apple Mail's URI detection algorithms stopped at the accented character
>   - When pasted into Twitter, it was converted into a tinyURL;
>   http://tinyurl.com/cw7hth
> which resolves to
>   http://www.target.com/Thomas-Engine-Peel-Stick-Appliqués/dp/B000Q74WFG/
> which still works, I suspect, only because they're using the string 
> after 'dp' to find a row in a database.
> 
> IMO this does not bode well for IRIs as identifiers, since one of the 
> big ideas that made URIs successful is the ability to cut and paste 
> them, write them down from billboards, etc.

Here's an example of an IRI that does work in twitter:

http://twitter.com/samruby/status/1289981841

- Sam Ruby

From [email-masked]  Sat Mar 14 03:12:22 2009
Date: Sat, 14 Mar 2009 06:12:56 -0400
From: John C Klensin <[email-masked]>
To: Mark Nottingham <[email-masked]>
Subject: Re: IDNs, IRIs, and URIs (again) (was: Re: Next call: March 13 1pm US/Pacific (updated agenda))
Cc: fd <[email-masked]>, Matt Womer <[email-masked]>, W3C/IETF <[email-masked]>

--On Friday, March 13, 2009 10:49 -0700 Mark Nottingham
<[email-masked]> wrote:

> In the meantime, I'm very interested in this topic, as I'm
> running up against a number of IRI-related issues in the Link
> draft.

It may be worth trying to set up a side-discussion among those
who are interested in this general topic.

> As a side note I was amused and frustrated to run across an
> IRI in the wild on a US site yesterday;
>=20
> =
http://www.target.com/Thomas-Engine-Peel-Stick-Appliqu=C3=A9s/dp/=
B
> 000Q74WFG/
> (notice the accent on Appliqu=C3=A9s).
>=20
> I cut-and-pasted it, and immediately noticed two problems;
>    - Apple Mail's URI detection algorithms stopped at the
> accented character
>    - When pasted into Twitter, it was converted into a =
tinyURL;
>    http://tinyurl.com/cw7hth
> which resolves to
>=20
> =
http://www.target.com/Thomas-Engine-Peel-Stick-Appliqu=C3=83=C2=A9=
s/dp
> /B000Q74WFG/
> which still works, I suspect, only because they're using the
> string after 'dp' to find a row in a database.
>=20
> IMO this does not bode well for IRIs as identifiers, since one
> of the big ideas that made URIs successful is the ability to
> cut and paste them, write them down from billboards, etc.

Some of the problem is "just" bugs.  Another part is the
specific issue I've been focused on from time to time, which has
to do with what is actually valid in a URI (which interacts with
the conversation during the call about how much practices
outweigh written specifications and standards, even when the
practices are demonstrably harmful or risky) and where an IRI
can validly and appropriately be used.

But there is also a more general problem which we can't fix.  If
you see a traditional URL in printed form, you can do some
pattern-matching to what you are expected to type on a keyboard
with under 100 characters.  With Unicode and the current (2003)
version of IDNA, the number of characters from which you have to
choose is around three orders of magnitude more than that (with
the IDNA2008 proposal, that number gets a lot smaller, but that
is one of the things some people are objecting to).  Similarly,
because of a lot of issues with coding and its variations,
issues of alternate representations of characters that Unicode
summarizes under the term "normalization" systems designed for
one-octet characters having do deal with multiple-octet ones
(sometimes of variable length), etc., copy-and-paste operations
(to quote Patrik Falstrom), generally don't work although there
are a lot of handy exceptions.  =20

That is going to be the nature of the beast for a rather long
time, perhaps forever, except in situations where one can
perform operations (including transcribing from print to
computers and copy-and-paste) under very strong localization
assumptions about what is going on.

It is probably worth mentioning that the original HTML spec
contributed significantly to the mess we have today by assuming
that any file containing octets with the high bit set was ISO
8859-1 (Latin-1), not UTF-8 or anything else that was much help
outside the range of Western European languages and their
writing systems.  Without knowing which pair is involved (I
might be able to guess if I played around for a bit), the
Twitter issue you describe above is most likely a case of the
character set that the system containing the URL assumed was
different from Twitter's assumption.  Unless the systems you are
using are immensely sophisticated about what is going on, you
are copying and pasting bits, not character abstractions, so,
unless you pass enough character set coding information to the
other application (copy and paste generally cannot and we
haven't defined other mechanisms) so it can sort things out, bad
things happen.

I find it sad, ironic, and symptomatic of the problems we face
that Martin D=C3=BCrst cannot successfully receive and send
non-ASCII characters in email because the native coding system
that is used for intercomputer communications in Japan is a
code-switching technique based on ISO 2022, not UTF-8.

If your example is looked at another way, it is an example of
why trying to educate folks that the standards are there for a
reason may be important.  If the "IRIs are user interface
matters" model were followed, then it would be the
responsibility of the IRI -> URI translator on your system to be
sure that=20
http://www.target.com/Thomas-Engine-Peel-Stick-Appliqu=C3=A9s/dp/=
B000Q74WFG/
was appropriately transcoded into UTF-8 (if necessary), then
properly mapped into all-ASCII (possibly with %-escapes) URI
form... and only those canonical, all-ASCII URIs would actually
be the subject of copy and paste operations.  Absent bugs, Apple
would have no problems parsing the resulting URI string and,
while Twitter might show you something you didn't want to see
(e.g., the string with %-escaped UTF-8 for the accented
character), it would at least work as you expected.

best,
    john

From [email-masked]  Sat Mar 14 08:53:03 2009
From: Thomas Roessler <[email-masked]>
To: Mark Nottingham <[email-masked]>
Subject: Re: Next call: March 13 1pm US/Pacific (updated agenda)
Date: Sat, 14 Mar 2009 16:53:18 +0100
Cc: fd <[email-masked]>, Matt Womer <[email-masked]>, W3C/IETF <[email-masked]>

Belated regrets.  I had been on the road for more than two weeks, and =20=

simply crashed when I made it home earlier that evening.

--=20
Thomas Roessler, W3C   <[email-masked]>

On 5 Mar 2009, at 10:01, Mark Nottingham wrote:

> Agenda:
> 0) select scribe
> 1) review action items
>  DONE: mnot to draft wiki page on IETF/W3C liaison
>  ACTION: mnot to propose times for 3/13 [DONE], 5/14, 7/16 liaison =20
> calls
>  DONE: plh to contact MDW about liaison response to IETF
>  DONE: plh to inform Arun of March 2 deadline, encourage quick I-D =20
> submission for Origin proposal
> 2) W3C Content Transformation Proxies guidelines [Francois Daoust]
>    <http://www.w3.org/mid/000001c97cd0$f6bd1b40$7a9eca3e@AREPPIM002>
> 3) Review wiki page <http://esw.w3.org/topic/IetfW3cLiaison>
> 4) GeoPriv liaison statement response [Matt Womer]
>   <https://datatracker.ietf.org/liaison/486/>
> 5) Quick list of new work at IETF74 -- MMOX, OAUTH bofs in =20
> particular [Lisa]
>   <http://www.ietf.org/meetings/74/>
> 6) IETF/HTML5 meeting  [Sam]
>   <http://esw.w3.org/topic/IETF_HTML5_Meeting_March_2009>
> 7) VOICEXML use of POST [Lisa]
>  <https://datatracker.ietf.org/idtracker/draft-ietf-mediactrl-vxml/>
> 8) draft-abarth-origin =
<http://ietfreport.isoc.org/idref/draft-abarth-origin/=20
> >
> 9) draft-abarth-mime-sniff =
<http://ietfreport.isoc.org/idref/draft-abarth-mime-sniff/=20
> >
> 10) draft-hixie-thewebsocketprotocol =
<http://ietfreport.isoc.org/idref/draft-hixie-thewebsocketprotocol/=20
> >
>
> Call details:
> Friday, 13 March 17:00-18:00 UTC  (1:00pm-2:00pm Boston local)
> =
<http://www.timeanddate.com/worldclock/fixedtime.html?month=3D03&day=3D13&=
year=3D2009&hour=3D17&min=3D00&sec=3D0&p1=3D0=20
> >
> Zakim Bridge +1.617.761.6200 <tel:+1.617.761.6200>, conference 4383 =20=

> (=93IETF=94)
> 10 participants
> IRC: irc.w3.org, port 6665  #ietf
>
> Expected:
> Lisa, Mark, Philippe, DanC, John, Francois Daoust, Sam Ruby, Matt =20
> Womer
> Regrets:
> TimBL
>
>
> --
> Mark Nottingham     http://www.mnot.net/

From [email-masked]  Sat Mar 14 08:53:16 2009
From: Thomas Roessler <[email-masked]>
To: John C Klensin <[email-masked]>
Subject: Re: IDNs, IRIs, and URIs (again) (was: Re: Next call: March 13 1pm US/Pacific (updated agenda))
Date: Sat, 14 Mar 2009 16:53:54 +0100
Cc: fd <[email-masked]>, W3C/IETF <[email-masked]>, Matt Womer <[email-masked]>

On 14 Mar 2009, at 11:12, John C Klensin wrote:

> It may be worth trying to set up a side-discussion among those
> who are interested in this general topic.

Count me in on that.  I'd hope we can also get DanC involved, as he'll  
be the W3Cer to attend the upcoming IETF.

-- 
Thomas Roessler, W3C   <[email-masked]>

From [email-masked]  Mon Mar 16 13:06:56 2009
Date: Mon, 16 Mar 2009 16:07:28 -0400
From: Leslie Daigle <[email-masked]>
To: Thomas Roessler <[email-masked]>
Subject: Re: IDNs, IRIs,	and URIs (again)
Cc: fd <[email-masked]>, Matt Womer <[email-masked]>, W3C/IETF <[email-masked]>, John C Klensin <[email-masked]>

De-lurking briefly -- I'd be up for the conversation.

Leslie.

Thomas Roessler wrote:
> On 14 Mar 2009, at 11:12, John C Klensin wrote:
> 
>> It may be worth trying to set up a side-discussion among those
>> who are interested in this general topic.
> 
> 
> Count me in on that.  I'd hope we can also get DanC involved, as he'll 
> be the W3Cer to attend the upcoming IETF.
> 

-- 

-------------------------------------------------------------------
"Reality:
      Yours to discover."
                                 -- ThinkingCat
Leslie Daigle
[email-masked]
-------------------------------------------------------------------

From [email-masked]  Mon Mar 16 20:13:35 2009
Date: Mon, 16 Mar 2009 23:14:13 -0400
From: John C Klensin <[email-masked]>
To: Leslie Daigle <[email-masked]>, Thomas Roessler <[email-masked]>
Subject: Re: IDNs, IRIs,	and URIs (again)
Cc: fd <[email-masked]>, Matt Womer <[email-masked]>, W3C/IETF <[email-masked]>

Are there going to be enough people at IETF, with enough spare
cycles, to make trying to find a time there, possibly for a
bar-BOF, worthwhile (I'm somewhat in doubt about my own
availability, but could try)?  Or should we pull together and
informal discussion/ mailing list?

My personal next step is probably to try to pull the details of
my "shift the problem out to the IRI/URI interface" suggestion
into an actual proposal that can be evaluated, but I could use
help and criticism of/with that and there are a lot of other
pieces of this that need exploration.

    john

--On Monday, March 16, 2009 16:07 -0400 Leslie Daigle
<[email-masked]> wrote:

> 
> De-lurking briefly -- I'd be up for the conversation.
> 
> Leslie.
> 
> Thomas Roessler wrote:
>> On 14 Mar 2009, at 11:12, John C Klensin wrote:
>> 
>>> It may be worth trying to set up a side-discussion among
>>> those who are interested in this general topic.
>> 
>> 
>> Count me in on that.  I'd hope we can also get DanC involved,
>> as he'll  be the W3Cer to attend the upcoming IETF.

From [email-masked]  Fri Mar 20 11:02:36 2009
Date: Fri, 20 Mar 2009 14:03:10 -0400
From: Leslie Daigle <[email-masked]>
To: John C Klensin <[email-masked]>
Subject: Re: IDNs, IRIs,	and URIs (again)
Cc: fd <[email-masked]>, Matt Womer <[email-masked]>, W3C/IETF <[email-masked]>

I haven't seen/heard other responses here.  I'll be at the IETF, but am 
doubtful about spare cycles.    If others have, I'll see what I can do.

Otherwise -- I'm happy with an e-mail discussion.

Leslie.

John C Klensin wrote:
> Are there going to be enough people at IETF, with enough spare
> cycles, to make trying to find a time there, possibly for a
> bar-BOF, worthwhile (I'm somewhat in doubt about my own
> availability, but could try)?  Or should we pull together and
> informal discussion/ mailing list?
> 
> My personal next step is probably to try to pull the details of
> my "shift the problem out to the IRI/URI interface" suggestion
> into an actual proposal that can be evaluated, but I could use
> help and criticism of/with that and there are a lot of other
> pieces of this that need exploration.
> 
>     john
> 
> 
> --On Monday, March 16, 2009 16:07 -0400 Leslie Daigle
> <[email-masked]> wrote:
> 
>> De-lurking briefly -- I'd be up for the conversation.
>>
>> Leslie.
>>
>> Thomas Roessler wrote:
>>> On 14 Mar 2009, at 11:12, John C Klensin wrote:
>>>
>>>> It may be worth trying to set up a side-discussion among
>>>> those who are interested in this general topic.
>>>
>>> Count me in on that.  I'd hope we can also get DanC involved,
>>> as he'll  be the W3Cer to attend the upcoming IETF.
> 
> 
> 
> 

-- 

-------------------------------------------------------------------
"Reality:
      Yours to discover."
                                 -- ThinkingCat
Leslie Daigle
[email-masked]
-------------------------------------------------------------------

From [email-masked]  Fri Mar 20 15:32:41 2009
From: Mark Nottingham <[email-masked]>
To: W3C/IETF <[email-masked]>
Subject: 5/14 teleconference scheduling
Date: Fri, 20 Mar 2009 15:33:24 -0700

Please vote for your preferred times at:
   http://doodle.com/udv8cb7pfw8nbvm6

Cheers,

--
Mark Nottingham     http://www.mnot.net/

From [email-masked]  Fri Mar 20 15:43:39 2009
From: Mark Nottingham <[email-masked]>
To: W3C/IETF <[email-masked]>
Subject: DRAFT minutes from 13 March
Date: Fri, 20 Mar 2009 15:44:20 -0700

IETF/W3C Liaison Meeting
13 Mar 2009

Attendees

  Present
         DanC, Matt, lisa, Johnk, Sam, mnot, plh
  Regrets
	TimBL
  Chair
         mnot

  Scribe
         Matt

Contents

    * [3]Topics
        1. [4]Action items
        2. [5]Content Transformation
        3. [6]Wiki page review
        4. [7]Geopriv
        5. [8]IETF 74
        6. [9]IETF HTML5 bar BOF
        7. [10]VoiceXML use of POST
        8. [11]draft-abarth-origin
        9. [12]origin
       10. [13]mime sniff
       11. [14]Other business
    * [15]Summary of Action Items

Action items

  mnot: Draft of wiki, everyone okay with it?

  <DanC> <[16]http://esw.w3.org/topic/IetfW3cLiaison>

    [16] http://esw.w3.org/topic/IetfW3cLiaison%3E

  DanC: I tweaked it a bit.

  lisa: I havent' looked yet.

Content Transformation

  francois: You want an introduction to the CT guidelines, I take it.
  ... CT Proxies were introduced by mobile carriers to allow mobile
  users to access the Web at large.
  ... In theory it's a good idea, but in practice... there are many
  legacy servers that return errors whent hey don't know the UA, so
  the proxies instead replace the UA string with a well known one to
  trick
  ... the server into thinking they know who they are.
  ... But in the mobile world, the UA string is essential due to
  fragmentation. Mobile content creators adapt the resource based on
  the capabilties of the device found in the UA string.
  ... These proxies ruined carefully crafted content...

  <francois> x-mobile-ua, x-device-user-agent, x-original-user-agent

  francois: Now CT proxies provide the original UA string in a
  separate header field. There was no real consensus, so each one came
  up with their own strings, using X-...
  ... Now with this guideline we're trying to define some practices
  that will bring some order back to the world.
  ... This way CT proxies can still add value for legacy pages, but
  allow mobile developers to be happy.
  ... Current draft says to send the original UA agent, but if you
  receive a response that doesn't look right, then send the request
  again with the fake UA.
  ... That doesn't satisfy everyone... they also want to use a single
  HTTP header field.
  ... There's no immediate benefit to adding another new header... so,
  can we keep the X- prefix and how can we migrate?
  ... The X- header field is already deployed. How do we migrate to
  not having it?

  mnot: rfc 3864 describes the header field registration policies.
  ... I don't remember specifically if we completely disallow X-, but
  I think from the way you describe it you might have a rationale to
  grandfather it in.
  ... It's in wide use?

  francois: How wide?

  <lisa> Have you seen [17]http://www.ietf.org/rfc/rfc4236.txt ?

    [17] http://www.ietf.org/rfc/rfc4236.txt

  mnot: 2 or more implementations deployed...

  <DanC> (a search for "x-" in [18]http://tools.ietf.org/html/rfc3864
  fails)

    [18] http://tools.ietf.org/html/rfc3864

  mnot: I don't see anything in the rfc that says you can't use X-...
  you could make the in use argument. You could also register
  something without the X- prefix.

  <plh> John Klensin

  JcK: Even if you register the X- there's a non-trivial risk that
  someone is using the same string with different semantics.
  ... It's worse in X- because it's been custom for others to come
  along later and reuse them with a different meaning.

  plh: They did say they'd consider something other than X- right? But
  if there's another UA string in the headers, how do they name it,
  etc?

  mnot: The UA header does allow more than one value, it's a list of
  values. That should be the first place to look.

  DanC: X- doesn't occur in 3864, is that by design?

  mnot: I don't recall.

  DanC: The X-.. once their introduced, how do we get rid of them?
  x-www-form... it's everywhere. How do we get rid of them?

  mnot: Don't use them unless it's a private thing.

  JcK: This is a 25+ year old argument that we keep going around on.
  Only use it if it's extremely private, not on the public network.
  Never use one of these... names are cheap, register one if you must
  and if it doesn't work it goes unused.

  DanC: Why put energy into discouraging it at all? Is it just wasted
  breath?

  JcK: Long arguments about this...

  <DanC> (fyi... [19]http://www.mnot.net/blog/2009/02/18/x- "Stop it
  with the X- Already!" )

    [19] http://www.mnot.net/blog/2009/02/18/x-

  JcK: The private uses do have meaning, the key to registering these
  things is providing a minimal description.
  ... If it's private, and I don't want the public to know what it is,
  perhaps there's a justification there...
  ... RFC ???? took a different position than 2822, and 56?? took a
  slightly different take on that...

  mnot: While RFC [media types] says X- shouldn't be registered.

  <DanC> (provisional registries are one of the best ways to mitigate
  these problems, IMO)

  JcK: Many of the authors of these RFCs have the wounds of it...

  mnot: Does this clarify enough to make progress or add confusion?

  DanC: Least cost seems to be to keep using X-.

  mnot: Use a proper name, but if it hurts adoption or vendors scream,
  then you could get it grandfathered in.

  francois: I expect that we'll get some negative feedback from the
  IETF and the w3c as well. If we have a strong use case we could
  register the X- if need be.

  mnot: HTTPbis can't give a formal recommendation, but we could get
  someone to review the document.

  francois: We did for the first draft already, and will for the
  second one I imagine.

Wiki page review

  [20]http://esw.w3.org/topic/IetfW3cLiaison

  mnot: Any comments?

Geopriv

  <plh> Matt: I've been encouraging the geo chairs to come up with a
  formal reply.

  <DanC> wow... this liaison statement is *still* pending?

  <plh> Matt: it's taking time and I apologize for the delay

  <plh> ... Richard Barnes was in attendance for the geo f2f meeting

  <plh> ... came up with a consensus

  <plh> ... updated the draft

  <plh> ... planning to re-open this can of worms for the next draft

  <plh> Mark: when will we receive a response?

  <plh> Matt: was supposed to come up by last Friday

  <DanC> (I got myself an android/G1 phone a week or so ago... so this
  privacy stuff is now a real-world concern of mine. Maybe I'll take
  another look.)

  <plh> ACTION: Matt to follow up on geopriv liaison statement
  [recorded in
  [22]http://www.w3.org/2009/03/13-ietf-minutes.html#action01]

  <plh> Plh: since the co-chair of geopriv attended the f2f meeting,
  it was assumed that consensus obtained was enough to move forward

  <plh> Lisa: Richard is now chair of the geopriv wg

  <plh> Mark: we could cover recent changes in the IETF at the end

IETF 74

  mnot: IETF 74 is next week.

  lisa: There's a bof on XMTP (or XMPP?)
  ... There's a mail BOF.
  ... BOF on multi-participants online interactions, MMOX

  <DanC> I'll be there, FYI.
  [23]http://www.tripit.com/trip/show/id/1329957 arrive SFO Sun
  mid-day, depart SFO mid-day Thu Mar 26

    [23] http://www.tripit.com/trip/show/id/1329957

  lisa: Second Life, virtual world companies, etc, having a debate
  about interoperability and use cases and such. MMOX lots of
  interest.

  <Zakim> DanC, you wanted to ask date time of MMOX

  mnot: Tuesday 3:20-5.

  <JcK> The mail bof could have been called "find old stuff that has
  been lying around for years, is widely deployed and used, clean it
  up, and advance it to Internet Standard". There should be few, if
  any, substantive issues -- docs that raise substantive issues will
  be taken off the agenda"

  lisa: OAUTH bof should be interesting to W3C I assume. Work moving
  quite well on list after quiet period during holidays. Getting
  consensus on charter, and have new chairs and [scribe failure]
  ... IPR bof, copy right issues that have come up recently.
  ... bar bof on HTML5.
  ... Bi-directional HTTP, COMET, etc.

  mnot: That's during the app area meeting?

  lisa: Yes.

  <lisa> APPAREA :
  [24]http://www.ietf.org/proceedings/09mar/agenda/apparea.txt

  <JcK> DanC: OAUTH is at 1300 Monday, Apps Area at 0900

  lisa: The 2nd Life folks are interested in this bidirectional stuff
  and claim they've got a different use case.

  mnot: Are W3C people aware of copyright problems?

  lisa: There's a sun rise problem...

  DanC: The IETF note-well thing didn't cover that?

  mnot: Doesn't transfer copyright.
  ... There's an implication on standards that are published... the
  idea behind the change, I could be wrong, was that other standards
  organizations could re-use IETF text. Because of the sunrise
  problems they can't do that.

  <JcK> If I can get into the conversation, I can explain this stuff
  ... am very much in the middle

  mnot: e.g. link draft, I have pre-November 10th contributions with
  Note Well...
  ... Changes in IESG?

  <JcK> But folks claiming to speak for/be involved in the W3C are
  very active in the conversations.

  <mnot> [26]http://www.ietf.org/IESGmems.html

  <scribe> ACTION: plh to add mnot to Policy admins [recorded in
  [27]http://www.w3.org/2009/03/13-ietf-minutes.html#action02]

  mnot: Changes are not reflected on that link.

  lisa: The IETF mailing list for it...
  ... JcK now on IAB.
  ... There are other changes too.

  mnot: The most relavent are in apps and RAI.

IETF HTML5 bar BOF

  rubys: Only 10 people signed up so far, but may be more popular than
  that.

  lisa: IETF people are likely to not sign up on the wiki page.

  mnot: More likely to just drop in.

  lisa: Sitting room for 25 or so, but probably bigger than that.

  mnot: Can we get the wiki updated with location info?

  rubys: Someone who has more details can send it to me or update it
  themselves.

  <scribe> ACTION: rubys to update the HTML5 bar BOF page with
  details. [recorded in
  [29]http://www.w3.org/2009/03/13-ietf-minutes.html#action03]

  lisa: I don't know which room is assigned. Wednesday?

  rubys: Yes.

  <DanC> [30]http://esw.w3.org/topic/IETF_HTML5_Meeting_March_2009

    [30] http://esw.w3.org/topic/IETF_HTML5_Meeting_March_2009

  mnot: I see a lot of high level goals and a lot of concrete things
  to look at.

  rubys: Lots of issues we could talk about, not sure quite how to
  keep things moving.

  mnot: How much time?

  rubys: 8pm until whenever.

  mnot: Dinner before?
  ... We could go until 10 if we have the time.
  ... Is Ian coming? he's on the list.

  rubys: He's told me he's coming, but then says to others he may not.

  mnot: Anything we can do to prepare for this to make it successful?

  DanC: Should be good. Chris Wilson not certain?

  rubys: I think that's old data. I believe he's planning on being at
  this and Web open (?).

  <DanC> (what 7:30pm start time? "8pm Wednesday, March 25th")

  lisa: The 7:30 start time is rgiht at the end of the plenary, so
  some IETF people may not have had dinner.
  ... Room was reserved for 7:30...

  mnot: Might it be worth meeting ahead of time?

VoiceXML use of POST

  lisa: The IETF spec punted on interoperability questions by pointing
  to the w3c spec.
  ... The VoiceXML stuff talks about GET and POST, but... tried to get
  folks in IETF to write down stuff like this.

  DanC: Not clear to me that both parties must support chunk transfer
  encoding.

  lisa: Re-inforcing what the HTTP spec actually requires is often
  useful.
  ... It's worth re-iterating what's in the HTTP spec.

  [31]http://lists.w3.org/Archives/Public/www-voice/2009JanMar/0014.ht
  ml

    [31] http://lists.w3.org/Archives/Public/www-voice/2009JanMar/0014.html

  lisa: Are redirects appropriate? etc. we're trying to set standards
  for what the IETF standards must met when they use HTTP as a
  transport.
  ... I sent mail and haven't gotten an answer yet.

  mnot: You're talking about a profile of HTTP...

  lisa: If we could find the right people we could get this written
  down and referenced once.

  mnot: Identify extensibility points, and which points we could have
  variance across, etc. If there's something we could put into BIS it
  might be useful.

  [32]http://lists.w3.org/Archives/Public/www-voice/2009JanMar/0014.ht
  ml

    [32] http://lists.w3.org/Archives/Public/www-voice/2009JanMar/0014.html

  <DanC> matt, if you see mail like lisa's, please *reply* to confirm
  receipt.

  Matt: The chairs will be sending a response once they figure out
  what it should be. Looking for clarifications on the first two
  paragraphs and asking for review on the last paragraph.

  <DanC> I think senders can wait a couple days when they send a
  comment on a W3C WD, but more than a week is kinda off-putting

draft-abarth-origin

origin

mime sniff

  <DanC> mnot: the feedback from the HTTP WG was "Use Referer" and the
  question remains whether that suffices

  mnot: Are we going to review this in HTTP bis was DanC's question.

  <DanC> "The above algorithm is a willful violation of the HTTP

  <DanC> specification."

  mnot: It looked like they were specifying a mime-sniffing algorithm
  for browsers on top of HTTP, but that we weren't going to
  incorporate this into HTTP.

  DanC: It's not on top of HTTP, it's in violation...

  mnot: I think we'll have sufficient wiggle room in HTTP bis that
  they could do this...

  DanC: There's still some chatting to do?

  mnot: That's my impression.

  DanC: This is a huge hot button issue.

  mnot: If they want it published as an IETF standard they're going to
  need more consensus.

  rubys: I am pretty confident they want to publish it as a standard.

  DanC: I don't think they're breaking things, just writing down
  what's broken already.

  lisa: The way we deal with contentious things like this is to form
  working groups. We don't have a mechanism for reaching consensus
  when there's such a substantial difference of opinion.
  ... We now have several such topics that could be worthy of a second
  HTTP WG if we don't extend the current one.

  DanC: And if no one shows up?

  lisa: In a WG we have a way to make sure people play nicely. It's
  where there is a lack of a WG that there's less order.

  mnot: Getting to the point where there's agreement that there should
  be a standard that describes what this thing describes and getting
  to a charter is going to be difficult.

  lisa: If there was a way forward recommended too that would be
  great. A charter can have two deliverables, documenting what's there
  and how to move forward...

  DanC: Hixie spent 10 years trying to get browsers to follow the
  spec, but the browsers would end up losing market share...
  ... Users will think the browser is broken and not the server.

  <JcK> At the same time, some of those practices, however
  well-established, can cause rather serious problems including
  security ones... and there, behavior sometimes does change.

  <DanC> yes, JcK, I think there's a pretty good argument on the other
  side... it'll be tricky to get people to consider both sides

  <lisa> yeah, sorry it was so confusing too

  mnot: I fear in 10-12 years you're going to have to publish a media
  type, and a 3 page algorithim on how to sniff it...

  <JcK> There are pretty good arguments on both sides. The problem is,
  indeed, to get people to consider both, rather than repeating the
  same position over and over again.

  mnot: I think it needs to be handled very carefully.
  ... Web socket protocol is totally different in that it's not trying
  to document anything that's there, just something totally new.

Other business

  mnot: Next meeting, 14th of May. No particular time.
  ... I'll chair the next two meetings.
  ... I'll be in Australia.

  JcK: I'll be in Nairobi.

Summary of Action Items

  [NEW] ACTION: Matt to follow up on geopriv liaison statement
  [recorded in
  [33]http://www.w3.org/2009/03/13-ietf-minutes.html#action01]
  [NEW] ACTION: plh to add mnot to Policy admins [recorded in
  [34]http://www.w3.org/2009/03/13-ietf-minutes.html#action02]
  [NEW] ACTION: rubys to update the HTML5 bar BOF page with details.
  [recorded in
  [35]http://www.w3.org/2009/03/13-ietf-minutes.html#action03]

  [End of minutes]

From [email-masked]  Sat Mar 21 12:40:58 2009
From: Tim Berners-Lee <[email-masked]>
To: Mark Nottingham <[email-masked]>
Subject: Re: 5/14 teleconference scheduling
Date: Sat, 21 Mar 2009 15:41:14 -0400
Cc: W3C/IETF <[email-masked]>

--Apple-Mail-321--488246571
Content-Type: text/plain;
	charset=US-ASCII;
	format=flowed;
	delsp=yes
Content-Transfer-Encoding: 7bit

"A script from "http://doodle.com" is requesting enhanced abilities  
that are UNSAFE and could be used to compromise your machine or data:

- Run or install software on your machine

Allow these abilities only if you trust this source to be free of  
viruses or malicious programs."

Do you need me to do this?  Do you know what doodle wants to do?

Tim

On 2009-03 -20, at 18:33, Mark Nottingham wrote:

> Please vote for your preferred times at:
>  http://doodle.com/udv8cb7pfw8nbvm6
>
> Cheers,
>
> --
> Mark Nottingham     http://www.mnot.net/

--Apple-Mail-321--488246571
Content-Type: text/html;
	charset=US-ASCII
Content-Transfer-Encoding: quoted-printable

<html><body style=3D"word-wrap: break-word; -webkit-nbsp-mode: space; =
-webkit-line-break: after-white-space; ">"A script from "<a =
href=3D"http://doodle.com">http://doodle.com</a>" is requesting enhanced =
abilities that are UNSAFE and could be used to compromise your machine =
or data:<div><br></div><div>- Run or install software on your =
machine</div><div><br></div><div>Allow these abilities only if you trust =
this source to be free of viruses or malicious =
programs."</div><div><br></div><div>Do you need me to do this? &nbsp;Do =
you know what doodle wants to =
do?</div><div><br></div><div>Tim</div><div><br></div><div><div>On =
2009-03 -20, at 18:33, Mark Nottingham wrote:</div><br =
class=3D"Apple-interchange-newline"><blockquote type=3D"cite"><div>Please =
vote for your preferred times at:<br> &nbsp;<a =
href=3D"http://doodle.com/udv8cb7pfw8nbvm6">http://doodle.com/udv8cb7pfw8n=
bvm6</a><br><br>Cheers,<br><br>--<br>Mark Nottingham =
&nbsp;&nbsp;&nbsp;&nbsp;<a =
href=3D"http://www.mnot.net/">http://www.mnot.net/</a><br></div></blockquo=
te></div><br></body></html>=

--Apple-Mail-321--488246571--

From [email-masked]  Sat Mar 21 12:47:39 2009
From: Mark Nottingham <[email-masked]>
To: Tim Berners-Lee <[email-masked]>
Subject: Re: 5/14 teleconference scheduling
Date: Sat, 21 Mar 2009 12:48:23 -0700
Cc: W3C/IETF <[email-masked]>

I sent you a message about this a little while ago. AFAICT, the page  
isn't doing anything unusual; it uses Google ads and analytics, and a  
few local things to manage time zones. However, I'm not a Web security  
expert (nudging Thomas...).

FWIW, neither my Safari (3.2.1) nor my Firefox (3.0.7) complains about  
this... perhaps you're running some extra in-browser software, or are  
running through a non-transparent proxy?

Cheers,

On 21/03/2009, at 12:41 PM, Tim Berners-Lee wrote:

> "A script from "http://doodle.com" is requesting enhanced abilities  
> that are UNSAFE and could be used to compromise your machine or data:
>
> - Run or install software on your machine
>
> Allow these abilities only if you trust this source to be free of  
> viruses or malicious programs."
>
> Do you need me to do this?  Do you know what doodle wants to do?
>
> Tim
>
> On 2009-03 -20, at 18:33, Mark Nottingham wrote:
>
>> Please vote for your preferred times at:
>>  http://doodle.com/udv8cb7pfw8nbvm6
>>
>> Cheers,
>>
>> --
>> Mark Nottingham     http://www.mnot.net/
>

--
Mark Nottingham     http://www.mnot.net/

From [email-masked]  Sat Mar 21 14:32:13 2009
Date: Sat, 21 Mar 2009 17:32:52 -0400
From: John C Klensin <[email-masked]>
To: Mark Nottingham <[email-masked]>, Tim Berners-Lee <[email-masked]>
Subject: Re: 5/14 teleconference scheduling
Cc: W3C/IETF <[email-masked]>

--On Saturday, March 21, 2009 12:48 -0700 Mark Nottingham
<[email-masked]> wrote:

> I sent you a message about this a little while ago. AFAICT,
> the page isn't doing anything unusual; it uses Google ads and
> analytics, and a few local things to manage time zones.
> However, I'm not a Web security expert (nudging Thomas...).
> 
> FWIW, neither my Safari (3.2.1) nor my Firefox (3.0.7)
> complains about this... perhaps you're running some extra
> in-browser software, or are running through a non-transparent
> proxy?

The NoScript plugin (available for several browsers, I believe,
but I run it with Firefox) does detects that Doodle is trying to
run its own scripts plus Google analytics.  I haven't detected
anything hostile with the former and it seems to run fine if
Google analytics stay disabled).

   john