Subject: Re: [apps-discuss] Revised webfinger draft (-02)

From: Gonzalo Salgueiro <[email-masked]>
Date: Wed, 4 Apr 2012 15:15:37 -0400

Peter -

Late to this party but I do want to weigh in and agree with what you, Eran and Paul have stated. This work is very narrowly scoped and adds minimal normative elements over and above RFC 6415 (primarily the addition of an acct URI and link rel as well as the resource parameter). I think the draft clearly states this but I'm willing to add text to further clarify if some is suggested.  The notion of this work being handled by another WG other than the one that shepherded RFC 6415 (APPSAWG) seems imprudent.  There is plenty of interest in progressing this work and I'd hate to further delay progress by not being able to find a suitable home for the document given the work that preceded it and that it is clearly founded on.   

Given the narrow focus of the work and the fact that we have received a significant amount of feedback, we believe this document is fairly mature and nearing a final form. We have released 3 versions and are about a week from submitting a fourth based on the latest round of comments. What is a reasonable way forward to continue the work? Do we continue it as an individual submission that might be AD-sponsored? Or do we adopt it as a WG?

Thanks!

Gonzalo

On Mar 30, 2012, at 4:45 AM, Peter Saint-Andre wrote:

> On 3/30/12 4:26 AM, Eran Hammer wrote:
>> And my answer is that right now it is a small task, but the responses
>> indicated that some people might want it to be bigger.
> 
> I also think it's a small task. If some people construe it as larger,
> then perhaps we need to clarify the scope in the document.
> 
> Peter
> 
> -- 
> Peter Saint-Andre
> https://stpeter.im/
> 
> 
> _______________________________________________
> apps-discuss mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/apps-discuss
>

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Wed, 4 Apr 2012 21:07:00 +0000

Since you pointed out that it could be the case that this is a small task that uses grand language, could the authors consider adjusting the latter condition to highlight the former?  That might make adopting it here easier to do.

-MSK

From: Eran Hammer [mailto:[email-masked]]
Sent: Thursday, March 29, 2012 7:27 PM
To: Murray S. Kucherawy; [email-masked]
Subject: RE: [apps-discuss] Revised webfinger draft (-02)

And my answer is that right now it is a small task, but the responses indicated that some people might want it to be bigger.

EH

From: [email-masked]<mailto:[email-masked]> [mailto:[email-masked]] On Behalf Of Murray S. Kucherawy
Sent: Thursday, March 29, 2012 10:12 AM
To: [email-masked]<mailto:[email-masked]>
Subject: Re: [apps-discuss] Revised webfinger draft (-02)

I'm not advocating throwing anything away.  I'm proposing figuring out what path would be most appropriate, regardless of whether it's a new innovation or a derivative innovation.

Our charter constrains us to small tasks.  If webfinger can legitimately be characterized as a small task, then we can do a call for adoption.  If not, which seems to be the case, then this isn't the right place for it, and we have other procedures for advancing such work.  That's the question I'm posing here.

-MSK

From: Eran Hammer [mailto:[email-masked]]<mailto:[mailto:[email-masked]]>
Sent: Thursday, March 29, 2012 9:47 AM
To: Murray S. Kucherawy; [email-masked]<mailto:[email-masked]>
Subject: RE: [apps-discuss] Revised webfinger draft (-02)

It would be appropriate for APPSAWG if the scope is narrowly defined as adding a few enhancements to RFC 6415 (which *is* what the current draft attempts to do, even though its prose might sounds grander). But in the context of the recent OAuth WG meeting discussing a competing foundation (SWD), a new WG seems to be in order.

My concern is that we are reaching a point (or maybe pass it) where progressing a work to standards track RFC status no longer translate into requiring new work to explain why it cannot build on top of the published standard. If this body throws away work as recent as October 2011 just because it's more convenient for some to start from scratch, I don't see why anyone would bother go through the significant cost and effort of getting it published here in the first place.

EH

From: [email-masked]<mailto:[email-masked]> [mailto:[email-masked]] On Behalf Of Murray S. Kucherawy
Sent: Thursday, March 29, 2012 9:18 AM
To: [email-masked]<mailto:[email-masked]>
Subject: Re: [apps-discuss] Revised webfinger draft (-02)

That sounds like a mighty strong statement that, in any case, it's not appropriate for APPSAWG.

Perhaps the proponents should request a non-WG list to talk about it for a while to let the problem definition congeal for a while, and then request a working group when a charter falls out of that.

-MSK

From: Eran Hammer [mailto:[email-masked]]<mailto:[mailto:[email-masked]]>
Sent: Thursday, March 29, 2012 9:03 AM
To: Murray S. Kucherawy; [email-masked]<mailto:[email-masked]>
Subject: RE: [apps-discuss] Revised webfinger draft (-02)

This clearly does not belong in the Security area or the OAuth working group.

I would strongly warn that moving this effort into any WG requires very careful work on the charter as historically there has been very little consensus and success in agreeing on what problems we are trying to solve. RFC 6415 was the end of a 5+ years process across multiple standard bodies including the IETF, W3C, OASIS, and the OpenID Foundation. This has proved a really hard problem to *define*.

EH

From: [email-masked]<mailto:[email-masked]> [mailto:[email-masked]] On Behalf Of Murray S. Kucherawy
Sent: Thursday, March 29, 2012 6:57 AM
To: [email-masked]<mailto:[email-masked]>
Subject: Re: [apps-discuss] Revised webfinger draft (-02)

Having talked with Barry now, an amended question:

Would this work better fit in another working group like OAuth (which has its own interest and concerns in webfinger), or perhaps in its own working group?  It may well be that it's too big to fit in APPSAWG's charter for smaller work items.

-MSK

From: [email-masked]<mailto:[email-masked]> [mailto:[email-masked]]<mailto:[mailto:[email-masked]]> On Behalf Of Murray S. Kucherawy
Sent: Thursday, March 29, 2012 4:35 AM
To: [email-masked]<mailto:[email-masked]>
Subject: Re: [apps-discuss] Revised webfinger draft (-02)

To the working group,

This has been hovering outside APPSAWG for two meetings now.  Is APPSAWG the right place to process it?  That is, should we bring it in as a working group document?  Or would it be better done through the ISE, or perhaps in some other working group?

-MSK

From: [email-masked]<mailto:[email-masked]> [mailto:[email-masked]] On Behalf Of Paul E. Jones
Sent: Wednesday, March 28, 2012 6:50 PM
To: [email-masked]<mailto:[email-masked]>
Subject: [apps-discuss] Revised webfinger draft (-02)

Folks,

I published a revised version of the Webfinger specification based on feedback I've received so far that seems to  have general agreement.  As requested, I added a change log at the end of the document that I hope will help.  The draft is here:
http://tools.ietf.org/html/draft-jones-appsawg-webfinger-02

The "diff" tool on that page allows you to quickly see exactly what changed.

Paul

---

From: "Paul E. Jones" <[email-masked]>
Date: Thu, 5 Apr 2012 02:08:15 -0400

Murray,

WebFinger is a concept that has been under discussion for a long time, both
inside and outside the IETF.  The core foundation of WebFinger is documented
in RFC 6415, which defines how to query for host metadata and to build a
resource descriptor document for a given resource.  This is what we need to
discover information about people and objects, though it does not say
explicitly how one should discover information about a person.  It stops
just short of that, leaving open the options of using an email address,
something like an email address, etc.  Discussion continued on that and
folks converged on the "acct" URI scheme.

There was also discussion that we needed to mandate JSON to appeal to most
developers.  RFC 6415 specifies both and recommends that servers support
JSON, but only requires XML.  Numerous people wanted to see that changed,
some arguing for JSON only.  We took the compromising position of requiring
the server to provide both.  (It's trivial to implement on the server side
and allows the client to use what it prefers.)   There were also requests on
the Webfinger (external) list to support CORS.

So with those points of convergence, we drafted the WebFinger spec to build
on RFC 6415, adding the things people wanted in WebFinger.  The draft:

.         Introduces the acct URI scheme for use with RFC 6415

.         Introduces the acct link relation for the same (as per RFC 5988)

.         Mandates server-side support for JRD (defined in RFC 6415)

.         Mandates server-side use of CORS

.         Introduces a "resource" parameter to be used with RFC 6415

What I have observed is that there are a number of people who have been
following and participating in the work on WebFinger.  Those people see this
draft as "completing the work" by registering the "acct" (user account)
related URI scheme and link relation and specifying those other few things.

Then there is the group of people who I believe were largely unaware of RFC
6415's existence.  That may not be correct, but I got the impression that
some believed we were creating everything from scratch in this draft, while
were actually just building on RFC 6415.  As an example, one person
commented that "LRDD" was not defined.  Indeed, our draft does not define
it, since it was defined in RFC 6415.  One person stated that JRD is only
documented on a blog, apparently unaware that JRD is defined and documented
in RFC 6415.

So, I submit that the draft is not using grand language and makes no attempt
to appear bigger than it is.  What I believe we have is two camps: those who
have been following the work and see it for what it is and those who have
not and are seeing this for the first time.  This is not unexpected, though
I do not want people to be left with the impression that this is all new.  I
think that's the most important misconception to address.

I hope this message clarifies the situation.  I, too, would like to see work
on this document go forward.  This is the WG where discussion took place on
RFC 6415, so I assume it is the right venue for these extensions to that
document.  It's certainly not a significant amount of work and not "foreign"
work to this group.  (I believe my email might actually be approaching then
length of the draft now, so I should stop.)

Paul

From: [email-masked] [mailto:[email-masked]]
On Behalf Of Murray S. Kucherawy
Sent: Wednesday, April 04, 2012 5:07 PM
To: [email-masked]
Subject: Re: [apps-discuss] Revised webfinger draft (-02)

Since you pointed out that it could be the case that this is a small task
that uses grand language, could the authors consider adjusting the latter
condition to highlight the former?  That might make adopting it here easier
to do.

-MSK

EH

From: [email-masked] [mailto:[email-masked]]
On Behalf Of Murray S. Kucherawy
Sent: Thursday, March 29, 2012 10:12 AM
To: [email-masked]
Subject: Re: [apps-discuss] Revised webfinger draft (-02)

I'm not advocating throwing anything away.  I'm proposing figuring out what
path would be most appropriate, regardless of whether it's a new innovation
or a derivative innovation.

Our charter constrains us to small tasks.  If webfinger can legitimately be
characterized as a small task, then we can do a call for adoption.  If not,
which seems to be the case, then this isn't the right place for it, and we
have other procedures for advancing such work.  That's the question I'm
posing here.

-MSK

It would be appropriate for APPSAWG if the scope is narrowly defined as
adding a few enhancements to RFC 6415 (which *is* what the current draft
attempts to do, even though its prose might sounds grander). But in the
context of the recent OAuth WG meeting discussing a competing foundation
(SWD), a new WG seems to be in order.

My concern is that we are reaching a point (or maybe pass it) where
progressing a work to standards track RFC status no longer translate into
requiring new work to explain why it cannot build on top of the published
standard. If this body throws away work as recent as October 2011 just
because it's more convenient for some to start from scratch, I don't see why
anyone would bother go through the significant cost and effort of getting it
published here in the first place.

EH

 

From: [email-masked] [mailto:[email-masked]]
On Behalf Of Murray S. Kucherawy
Sent: Thursday, March 29, 2012 9:18 AM
To: [email-masked]
Subject: Re: [apps-discuss] Revised webfinger draft (-02)

That sounds like a mighty strong statement that, in any case, it's not
appropriate for APPSAWG.

Perhaps the proponents should request a non-WG list to talk about it for a
while to let the problem definition congeal for a while, and then request a
working group when a charter falls out of that.

-MSK

This clearly does not belong in the Security area or the OAuth working
group.

I would strongly warn that moving this effort into any WG requires very
careful work on the charter as historically there has been very little
consensus and success in agreeing on what problems we are trying to solve.
RFC 6415 was the end of a 5+ years process across multiple standard bodies
including the IETF, W3C, OASIS, and the OpenID Foundation. This has proved a
really hard problem to *define*.

EH

From: [email-masked] [mailto:[email-masked]]
On Behalf Of Murray S. Kucherawy
Sent: Thursday, March 29, 2012 6:57 AM
To: [email-masked]
Subject: Re: [apps-discuss] Revised webfinger draft (-02)

Would this work better fit in another working group like OAuth (which has
its own interest and concerns in webfinger), or perhaps in its own working
group?  It may well be that it's too big to fit in APPSAWG's charter for
smaller work items.

-MSK

From: [email-masked] [mailto:[email-masked]]
On Behalf Of Murray S. Kucherawy
Sent: Thursday, March 29, 2012 4:35 AM
To: [email-masked]
Subject: Re: [apps-discuss] Revised webfinger draft (-02)

To the working group,

This has been hovering outside APPSAWG for two meetings now.  Is APPSAWG the
right place to process it?  That is, should we bring it in as a working
group document?  Or would it be better done through the ISE, or perhaps in
some other working group?

-MSK

From: [email-masked] [mailto:[email-masked]]
On Behalf Of Paul E. Jones
Sent: Wednesday, March 28, 2012 6:50 PM
To: [email-masked]
Subject: [apps-discuss] Revised webfinger draft (-02)

Folks,

I published a revised version of the Webfinger specification based on
feedback I've received so far that seems to  have general agreement.  As
requested, I added a change log at the end of the document that I hope will
help.  The draft is here:

Paul