Subject: Re: [apps-discuss] webfinger goals & whether we care about $5/month hosting

From: John Bradley <[email-masked]>
Date: Mon, 26 Nov 2012 17:23:14 -0300

Brad,

I think a Google blog post in Oct of 2011 put the number of Apps for domains customers (all types) at 4 Million Businesses and 40 Million users.

Without allowing for growth if that is 50% of the hosting market that is 80Million users.

I am not personally associated with any of these but it seems like a significant user population especially as these users represent a growing consumer segment of SaaS services.

openID Connect ignoring this user group seems like a disservice.

Due to concerns over phishing, if Connect uses WF it will need to be over TLS.  

Telling companies that they need to change web hosting companies so that Google or Sales force can provide Identity services seems like a hard sell.

One problem with using WF is that it puts web hosting people in charge of something that is used for security infrastructure.

My father who is a redneck also runs a multi million dollar business, with over 500 employes and is increasingly relying on outsourced SaaS, and that requires Federated identity of some sort to do well.

The business is parking lots(not making it up) so there web site is not seen as mission critical.  Where email and perhaps SalesForce arguably are.

How do we help these millions of businesses?   

Perhaps saying nothing can be done for them until we have new WF enabled providers who can link discovery to the email and other identity services is an option.

I think WF needs to decide if this is an important use case and if it is what is the best way to solve the problem that real users can deal with.

Regards

John B.

On 2012-11-26, at 4:56 PM, Brad Fitzpatrick <[email-masked]> wrote:

> One of the reasons WebFinger development has moved so slowly (while proprietary silos continue to grow) is that we as a community have no focus, no deadlines, no decision makers, and no clear goals even.
> 
> After seeing conflicting opinions both on lists and off-list, I'd like to discuss one goal (or non-goal) here:
> 
> Does WebFinger care about people on "$5/month" static domain hosting plans?
> 
> As one person asked off-list, "How do we solve this for my Father (a redneck luddite if you have ever met him)?"
> 
> Personally, I think we should not care about this group.  These theoretical "rednecks" won't run their own webfinger servers, and we shouldn't care.  Most users will use a service provider for their webfinger, and anybody that has their own domain name and really wants to be in charge of their own identity will be able to own their root and be able to serve dynamic content from it (and for LESS than "$5/month").  And if webfinger becomes successful enough for these tech "luddites" (who already pay for their own domain name?) to want WebFinger, the market will adapt: these static hosting providers can provide webfinger access for them, mapping to static files under the user's control.
> 
> Opinions?
> 
> Regardless, can we lay out the assumptions & goals in the spec, so people understand what webfinger aims to both solve and to NOT solve?
>

---

From: Joe Gregorio <[email-masked]>
Date: Mon, 26 Nov 2012 15:45:03 -0500

On Mon, Nov 26, 2012 at 2:56 PM, Brad Fitzpatrick <[email-masked]>wrote:

> One of the reasons WebFinger development has moved so slowly (while
> proprietary silos continue to grow) is that we as a community have no
> focus, no deadlines, no decision makers, and no clear goals even.
>

I don't think I'd phrase it as harshly as "don't care", but I do think it's
a huge mistake to let the existence of such
accounts limit WebFinger.

Also, isn't serving a 302 a static operation?

  -joe

>
> As one person asked off-list, "How do we solve this for my Father (a
> redneck luddite if you have ever met him)?"
>
> Personally, I think we should not care about this group.
>  These theoretical "rednecks" won't run their own webfinger servers, and we
> shouldn't care.  Most users will use a service provider for their
> webfinger, and anybody that has their own domain name and really wants to
> be in charge of their own identity will be able to own their root and be
> able to serve dynamic content from it (and for LESS than "$5/month").  And
> if webfinger becomes successful enough for these tech "luddites" (who
> already pay for their own domain name?) to want WebFinger, the market will
> adapt: these static hosting providers can provide webfinger access for
> them, mapping to static files under the user's control.
>
> Opinions?
>
> Regardless, can we lay out the assumptions & goals in the spec, so people
> understand what webfinger aims to both solve and to NOT solve?
>
>

-- 
Joe Gregorio        http://bitworking.org

---

From: Blaine Cook <[email-masked]>
Date: Mon, 26 Nov 2012 13:31:30 -0800 (PST)

Agreed, re: goals.

There are a lot of self-hosted domains out there. I'd suspect that a lot of 
corporate domains are just haphazardly managed by someone more-or-less 
competent. For personal domains, there will be a bunch at wordpress.com (or 
on some provider but effectively managed by wordpress), and others all over 
the place.

My goals for webfinger are as follows:

1. That it be easy to have any given domain to support webfinger.
2. That delegating service (and revoking that delegation) for a given 
domain is possible, as this will be (by far) the most common deployment 
mode.
3. That updates to profile information be available immediately, or as 
near-to-immediate as possible.
4. That it be easy to write client software for webfinger. Ideally, this 
means that a bespoke webfinger lookup is doable as a few lines of 
JS/Python/PHP/Ruby/Java without using a library, but that a more 
full-featured client library isn't more than a few hundred lines.

b.

---

From: Evan Prodromou <[email-masked]>
Date: Mon, 26 Nov 2012 20:12:22 -0500

So, I'm trying to get a handle on this situation. Here's what I'm hearing:

  * some organizations delegate the Web hosting of their domain to a
    SaaS provider.
  * Those organizations may want to implement Webfinger for e.g. OpenID
    Connect.
  * Their Web hosting provider may not allow mapping the
    /.well-known/webfinger endpoint to some other processor or even a
    redirect.
  * The organization may still have control of the domain and may be
    able to map the "webfinger" hostname to another Web server (or
    another SaaS provider).

It's an interesting case, but... there are a lot of "mights" and 
"maybes" in this.

As a client developer, I don't want to look in 4 places for the 
Webfinger document:

  * https://domain.example/.well-known/webfinger
  * http://domain.example/.well-known/webfinger
  * https://webfinger.domain.example/.well-known/webfinger
  * http://webfinger.domain.example/.well-known/webfinger

...and then fall back to RFC 6415 if none of these work:

  * https://domain.example/.well-known/host-meta
  * http://domain.example/.well-known/host-meta
  * https://domain.example/.well-known/host-meta.json
  * http://domain.example/.well-known/host-meta.json

Which is another 2-5 requests (since we have to get the linked LRDD 
document on a successful hit), for a total of 4-8 requests for 
non-implementing domains -- by far, right now, our mainline case.

I think it makes sense to worry about people who want to implement, but 
can't, once we actually have a widespread network of implementers. Until 
then, I believe the YAGNI 
<http://en.wikipedia.org/wiki/You_ain%27t_gonna_need_it> principle applies.

-Evan

---

From: James M Snell <[email-masked]>
Date: Mon, 26 Nov 2012 17:20:05 -0800

+1.. it's getting quite a bit complicated here overall... lots of what ifs,
maybes, mights, etc and very little hard evidence one way or the other.
Personally, I'm -1 on the subdomain notion. It just adds an unnecessary
headache.

- James

---

From: Peter Saint-Andre <[email-masked]>
Date: Mon, 26 Nov 2012 18:47:17 -0700

On 11/26/12 6:20 PM, James M Snell wrote:
> +1.. it's getting quite a bit complicated here overall... lots of
> what ifs, maybes, mights, etc and very little hard evidence one way
> or the other. Personally, I'm -1 on the subdomain notion. It just
> adds an unnecessary headache.

Agreed. Let's try to keep it simple (hey, this is just supposed to be
finger for the web, right?).

Peter

- -- 
Peter Saint-Andre
https://stpeter.im/

---

From: Melvin Carvalho <[email-masked]>
Date: Tue, 27 Nov 2012 03:24:57 +0100

> them, mapping to static files under the user's control.

Agree with this sentiment.  The scope of webfinger has expanded since the
original concept.

However, I'm not sure that cutting out the 'host your own' webfinger, is
the first thing to cut out.  That may exclude projects such as freedombox
from participating.

There are other areas that can be cut, imho, and the ietf process has a
good reputation in this area.

---

From: Nico Williams <[email-masked]>
Date: Mon, 26 Nov 2012 20:26:12 -0600

> Personally, I'm -1 on the subdomain notion. It just adds an unnecessary

Agreed.  I want one simple thing using service discovery (SRV RRs,
say) and at most one simple fallback (say, subdomain), preferably no
fallback.

---

From: Brad Fitzpatrick <[email-masked]>
Date: Mon, 26 Nov 2012 11:56:42 -0800

After seeing conflicting opinions both on lists and off-list, I'd like to
discuss one goal (or non-goal) here:

Opinions?

---

From: Nick Jennings <[email-masked]>
Date: Mon, 26 Nov 2012 21:18:26 +0100

+1 totally agree here.

If WebFinger catches on, the market will adapt to allow our Dads to
join in on all the fun. (In the meantime they still have their email
provider, gmail/outlook/yahoo etc.)

On Mon, Nov 26, 2012 at 8:56 PM, Brad Fitzpatrick <[email-masked]> wrote:
> proprietary silos continue to grow) is that we as a community have no focus,
> no deadlines, no decision makers, and no clear goals even.
>
> Personally, I think we should not care about this group.  These theoretical
> "rednecks" won't run their own webfinger servers, and we shouldn't care.
> Most users will use a service provider for their webfinger, and anybody that
> has their own domain name and really wants to be in charge of their own
> identity will be able to own their root and be able to serve dynamic content
> from it (and for LESS than "$5/month").  And if webfinger becomes successful
> enough for these tech "luddites" (who already pay for their own domain
> name?) to want WebFinger, the market will adapt: these static hosting
> providers can provide webfinger access for them, mapping to static files
> under the user's control.
>
> Opinions?
>

---

From: Brad Fitzpatrick <[email-masked]>
Date: Mon, 26 Nov 2012 12:47:50 -0800

On Mon, Nov 26, 2012 at 12:45 PM, Joe Gregorio <[email-masked]> wrote:

> I don't think I'd phrase it as harshly as "don't care", but I do think
> it's a huge mistake to let the existence of such

I actually think caring could be actively harmful:  if caring about a tiny
hypothetical userbase takes a simple spec and turns it into a complicated
spec (with, say: too many optional pieces for client & server to implement,
more crypto, etc), that could hinder adoption more than it helps.

---

From: "Paul E. Jones" <[email-masked]>
Date: Tue, 27 Nov 2012 14:24:08 -0500

Brad, et al,

I’ll tell you right now that I think the deadline is past and we need to get this done :)

Not to be taking sides on the “webfinger” subdomain issue, but I use hosting services that cost $1/mo and some approaching $100/mo.  I manage one account that is the more typical $6.95/mo.  In every instance, there is a web server and I have the ability to insert a 3xx redirection to a different location if I want.

Are there services out there that cannot allow customers to redirect requests using 3xx or insert an A record for the root of their domain?  I’ll also add that the DNS management can be entirely separate from the hosting provider.  I can use my registrar (Go Daddy), my hosting provider, or companies like dyn to provide DNS services.  Thus, if I did not run my own web server, I could map A for example.com to point to my WF service provider (who would likely provide other services).

If any of the above simply cannot work, we need some other mechanism.  What I don’t know, obviously, is “what I don’t know.” Are there truly domain owners who would not either be able to do 3xx or assign their domain’s A record?

Paul

From: [email-masked] [mailto:[email-masked]] On Behalf Of Brad Fitzpatrick
Sent: Monday, November 26, 2012 2:57 PM
To: [email-masked]; [email-masked]
Cc: Tim Bray
Subject: [apps-discuss] webfinger goals & whether we care about $5/month hosting

Opinions?

---

From: Nico Williams <[email-masked]>
Date: Tue, 27 Nov 2012 13:48:51 -0600

> provider, gmail/outlook/yahoo etc.)

Right, if WF is a killer app then providers will support it very
quickly.  We shouldn't focus on provider complexity then; we should
focus on client complexity instead.  IMO there should be one discovery
scheme: either as options to XHR modifying how http(s) URL servers are
resolved, or as a new URI scheme that involves service discovery.

Nico
--

---

From: Tim Bray <[email-masked]>
Date: Tue, 27 Nov 2012 12:06:26 -0800

OK, I checked around with the Googlers who are supposed to care about this
stuff, and there’s nobody here who’s willing to go to bat any more for the
subdomain idea.  So if anyone really wants to keep section 5.5, now would
be a good time to speak up.  -Tim

On Tue, Nov 27, 2012 at 11:48 AM, Nico Williams <[email-masked]> wrote:
> _______________________________________________
> apps-discuss mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/apps-discuss

---

From: Tim Bray <[email-masked]>
Date: Tue, 27 Nov 2012 12:02:14 -0800

---

From: Brad Fitzpatrick <[email-masked]>
Date: Tue, 27 Nov 2012 12:08:06 -0800

I agree the deadline is past.  Sorry for the distraction.  My point
bringing this up was for people to discuss the issue in one place (since it
kept coming up in various places) and hopefully agree this isn't actually a
problem.  I think we've established that.

The onus is not on the WebFinger specification authors to build training
wheels for people. You can speak HTTP at the right place (which is easy) or
you can not play.  No new mechanisms.

Hopefully we can carry on now?  Can we add to the spec that the assumption
that we're not catering to any current-day hosting provider's current
restrictions?  e.g. if Fooblog can't do this today out of the box, we don't
care. Fooblog sofware can support it tomorrow, since it's trivial.

On Tue, Nov 27, 2012 at 11:24 AM, Paul E. Jones <[email-masked]>wrote:

> Brad, et al,****
>
> ** **
>
> I’ll tell you right now that I think the deadline is past and we need to
> get this done :)****
>
> ** **
>
> Not to be taking sides on the “webfinger” subdomain issue, but I use
> hosting services that cost $1/mo and some approaching $100/mo.  I manage
> one account that is the more typical $6.95/mo.  In every instance, there is
> a web server and I have the ability to insert a 3xx redirection to a
> different location if I want.****
>
> ** **
>
> Are there services out there that *cannot* allow customers to redirect
> requests using 3xx *or* insert an A record for the root of their domain?
> I’ll also add that the DNS management can be entirely separate from the
> hosting provider.  I can use my registrar (Go Daddy), my hosting provider,
> or companies like dyn to provide DNS services.  Thus, if I did not run my
> own web server, I could map A for example.com to point to my WF service
> provider (who would likely provide other services).****
>
> ** **
>
> If any of the above simply cannot work, we need some other mechanism.
> What I don’t know, obviously, is “what I don’t know.” Are there truly
> domain owners who would not either be able to do 3xx or assign their
> domain’s A record?****
>
> ** **
>
> Paul****
>
> ** **
>
> *From:* [email-masked] [mailto:
> [email-masked]] *On Behalf Of *Brad Fitzpatrick
> *Sent:* Monday, November 26, 2012 2:57 PM
> *To:* [email-masked]; [email-masked]
> *Cc:* Tim Bray
> *Subject:* [apps-discuss] webfinger goals & whether we care about
> $5/month hosting****
>
> ** **
>
> focus, no deadlines, no decision makers, and no clear goals even.****
>
> ** **
>
> discuss one goal (or non-goal) here:****
>
> ** **
>
> ****
> redneck luddite if you have ever met him)?"****
>
> ** **
>
> them, mapping to static files under the user's control.****
>
> ** **
>
> Opinions?****
>
> understand what webfinger aims to both solve and to NOT solve?****
>