Subject: [websec] Are all the issues filed? (was: Re: Using IETF Tracker for issues on MIME sniffing?)

From: Adam Barth <[email-masked]>
Date: Sat, 22 Oct 2011 11:51:48 -0700

Larry,

Have you filed all the issues you'd like addressed?  I went though the
issue tracker and I only found two:

http://wiki.tools.ietf.org/wg/websec/trac/ticket/15
http://wiki.tools.ietf.org/wg/websec/trac/ticket/16

Below you mention "nosniff", but I don't see that in the issue
tracker.  Please let me know when you've finished filing the issues
you care about.

Adam

On Sat, Oct 15, 2011 at 4:52 PM, Larry Masinter <[email-masked]> wrote:
> Could we start using the IETF tracker to keep track of our conversation on the issues on MIME sniffing?
>
> The interaction with a "nosniff" header should be one issue.
> The other three big issues that come to mind are
>
> *  "scope" (do what situations does this apply)
>  * "opt-in case-by-case" (whether one either sniffs ALWAYS or sniffs NEVER, or whether it's more nuanced and based on expectation)
> * "normative algorithm vs. invariants for specifications".
>
>
> I'm willing to write up these issues and the sniffing ones from http://tools.ietf.org/html/draft-masinter-mime-web-info , and I hope we can capture Pete Resnick's issues as well as Alexey's.
>
> Larry
>
>
> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of Tobias Gondrom
> Sent: Sunday, October 02, 2011 2:44 PM
> To: [email-masked]
> Cc: [email-masked]
> Subject: Re: [websec] I-D Action:draft-ietf-websec-mime-sniff-03.txt
> Importance: Low
>
> <hat="individual">
> Whether browser will implement it, can't tell. Maybe we can learn more when we progress further with the mime-sniff draft.
>
> I don't have a strong opinion on the nosniff header.
> Depending on where the mime-sniff debate will lead us, it might be a way to mitigate concerns that in certain cases you really SHOULD NOT or MUST NOT (RFC2119) sniff. Well and with such a header you could enforce exactly that for your sources, without breaking other unknown things/sites - which is the main reason for many browser vendors to start do sniffing in the first place.
> (in one way nosniff could even be a migration path to less sniffing....)
>
> Best regards, Tobias
>
>
>
> On 01/10/11 15:30, Phillip Hallam-Baker wrote:
>> On Sat, Oct 1, 2011 at 2:47 AM, Adam Barth<[email-masked]>  wrote:
>>> On Fri, Sep 30, 2011 at 10:14 PM, "Martin J. Dürst"
>>> <[email-masked]>  wrote:
>>>> On 2011/09/29 11:45, Adam Barth wrote:
>>>>> On Wed, Sep 28, 2011 at 5:44 PM, "Martin J. Dürst"
>>>>> <[email-masked]>    wrote:
>>>>>> On 2011/09/29 8:26, Adam Barth wrote:
>>>>>>> As I recall, the nosniff directive is pretty controversial.
>>>>>> But then, as I recall, the whole business of sniffing is pretty
>>>>>> controversial to start with. Are there differences between the
>>>>>> controversiality of sniffing as such and the controversiality of
>>>>>> the nosniff directive that explain why one is in the draft and the
>>>>>> other is not?
>>>>> The reason why one is in and the other isn't is just historical.
>>>>> nosniff didn't exist at the time the document was originally written.
>>>> Your first answer sounded as if the nosniff directive was too
>>>> controversial to be included in any draft, but your second answer
>>>> seems to suggest that it was left out by (historical) accident, and
>>>> that it might be worth to include it.
>>> The essential question isn't whether we should include it in the
>>> draft.  The essential question is whether folks want to implement it.
>>> If no one wants to implement it, putting it in the draft is a
>>> negative.  If folks want to implement, then we can deal with the
>>> controversy.
>> +1
>>
>> The controversy seems to be of the 'cut off nose to spite face'
>> variety. Sniffing is definitely terrible from a security perspective
>> but people do it. Java and Java Script were terrible as well but
>> people did them and then left the rest of us with a mess that had to
>> be fixed slowly over then next ten years.
>>
>> Sure this is not something we should have to think about but the fact
>> is that the browsers do it and it is better for the standards to
>> describe what the browsers actually do than what people think they
>> should do.
>>
>>
>
> _______________________________________________
> websec mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/websec
> _______________________________________________
> websec mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/websec
>

---

From: Larry Masinter <[email-masked]>
Date: Sun, 23 Oct 2011 17:04:59 -0700

I'd meant to do more careful write-ups of the issues I put into the tracker, but I've put in the main issues left over from draft-masinter-mime-sniff. 

The document also contains several sections (on sniffing fonts, for example) which are left as TBD. I suppose each of those is a separate "issue" to fill out.

Larry

---

From: Tobias Gondrom <[email-masked]>
Date: Mon, 24 Oct 2011 04:17:12 +0100

> The document also contains several sections (on sniffing fonts, for example) which are left as TBD. I suppose each of those is a separate "issue" to fill out.

Thank you Larry.

I have a question regarding font sniffing:
Besides the short discussion at the last meetings, I do not recall much 
interest for that on the mailing-list. So, I am not sure how much 
interests really exists for the working group to be addressing that?
(i.e. adding content-types for fonts and adding them to the mime-sniff 
draft...)
Am I mistaken?

Kind regards, Tobias

---

From: Adam Barth <[email-masked]>
Date: Sun, 23 Oct 2011 20:22:16 -0700

On Sun, Oct 23, 2011 at 8:17 PM, Tobias Gondrom
<[email-masked]> wrote:
> I'd meant to do more careful write-ups of the issues I put into the tracker,
> but I've put in the main issues left over from draft-masinter-mime-sniff.
>
> The document also contains several sections (on sniffing fonts, for example)
> which are left as TBD. I suppose each of those is a separate "issue" to fill
> out.
>
> Larry
>
>
> Thank you Larry.
>
> interest for that on the mailing-list. So, I am not sure how much interests
> really exists for the working group to be addressing that?

I added to the TODOs to the spec at the request of Anne van Kesteren.
I have some notes about how how font sniffing is supposed to work, but
I haven't researched it thoroughly.  I don't recall anyone else asking
for it specifically.

Adam

---

From: "Anne van Kesteren" <[email-masked]>
Date: Mon, 24 Oct 2011 18:09:34 +0900

> (i.e. adding content-types for fonts and adding them to the mime-sniff

It is not so much about interest I think. If implementations sniff for  
fonts, it should be defined how they are to go about that.

-- 
Anne van Kesteren
http://annevankesteren.nl/

---

From: Tobias Gondrom <[email-masked]>
Date: Mon, 24 Oct 2011 10:13:45 +0100

> fonts, it should be defined how they are to go about that.

Thanks for the reply.

Well, AFAIK we don't even have a content-type for fonts in the IANA 
registry at the moment?
So my - maybe naive - question would be, do implementations sniff for 
fonts and why did they not ask for a content-type?

Tobias

---

From: "Anne van Kesteren" <[email-masked]>
Date: Mon, 24 Oct 2011 18:22:41 +0900

> Well, AFAIK we don't even have a content-type for fonts in the IANA

Could be. I have not checked recently. MIME types for fonts are pointless  
now.

> fonts and why did they not ask for a content-type?

Adding support for fonts to browsers went much quicker than getting font/*  
 from the IETF (I and some others tried doing that, maybe not in the right  
way though), and once browsers shipped with font support I stopped caring,  
because we would have to sniff forever anyway.

But who is at fault is not what we are interested in here I think. We are  
interested in defining when implementations have to sniff. They very much  
have to sniff for fonts.

---

From: Tobias Gondrom <[email-masked]>
Date: Mon, 24 Oct 2011 12:36:50 +0100

On 24/10/11 10:22, Anne van Kesteren wrote:
> Could be. I have not checked recently. MIME types for fonts are 
> pointless now.
>
>
> Adding support for fonts to browsers went much quicker than getting 
> font/* from the IETF (I and some others tried doing that, maybe not in 
> the right way though), and once browsers shipped with font support I 
> stopped caring, because we would have to sniff forever anyway.
>
> But who is at fault is not what we are interested in here I think. We 
> are interested in defining when implementations have to sniff. They 
> very much have to sniff for fonts.
>
>

ic. - And don't care much about the "who is at fault" question either.
But as the mime-sniff draft is considering using info in the IANA 
content-type registry for the mime-sniffing (i.e. magic numbers, ...), 
we would in that case also have to add the fonts mime-type to that 
registry eventually.
Btw. though I admit the IETF jungle can sometimes be daunting, no 
worries, registering a Mime-type / Content-type is not that difficult. 
As a WG we just shouldn't go through this exercise if in the end nobody 
really wants content-types for fonts or sniffing of them anyway.

So a specific use case for this could be helpful - and a volunteer to 
provide input on by which criteria exactly fonts should be sniffed and 
help with writing up the font mime-type for the registry (I can help 
with the latter).

Kind regards, Tobias

---

From: "Anne van Kesteren" <[email-masked]>
Date: Mon, 24 Oct 2011 20:43:45 +0900

> help with writing up the font mime-type for the registry (I can help

The use case is @font-face, CSS' font linking feature. The criteria I have  
emailed to this list before:

http://www.ietf.org/mail-archive/web/websec/current/msg00235.html

---

From: Larry Masinter <[email-masked]>
Date: Mon, 24 Oct 2011 09:51:28 -0700

It's been emphasized that there is no reason why third parties can't register media types if they're wanted. So there should be no barrier to specifying content-type for fonts, if that's what is wanted.

Why is it a "lost cause" when no one even tried?

Larry

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Anne van Kesteren
Sent: Monday, October 24, 2011 4:44 AM
To: Tobias Gondrom
Cc: [email-masked]
Subject: Re: [websec] font sniffing

> help with writing up the font mime-type for the registry (I can help 

The use case is @font-face, CSS' font linking feature. The criteria I have emailed to this list before:

---

From: "Martin J. Dürst" <[email-masked]>
Date: Tue, 25 Oct 2011 10:43:25 +0900

Hello Anne, Tobias, others,

> stopped caring, because we would have to sniff forever anyway.

Yes, at some point in the mid-to-late 1990s (as far as I remember, but 
there is also http://tools.ietf.org/html/draft-singer-font-mime-00, so 
maybe this was in 2004, or there were several attempts), there was an 
attempt to create a top-level font/ type.

At the time, this met with quite strong resistance from some Mime type 
experts who didn't want a proliferation of top level types. The question 
of what's the right top level type (font/ or application/) since then 
has discouraged registration (in addition to what Anne mentioned).

> are interested in defining when implementations have to sniff. They very
> much have to sniff for fonts.

Yes. If somebody has enough energy, it would still make sense to 
register font types.

Regards,   Martin.

---

From: "Martin J. Dürst" <[email-masked]>
Date: Tue, 25 Oct 2011 10:44:55 +0900

Hello Larry,

> Why is it a "lost cause" when no one even tried?

My guess is that Adobe has a font type or two (I might be wrong; in that 
case, appologies). So why don't you give it a try; it wouldn't even be a 
third-party registration in that case.

Regards,   Martin.

> On Mon, 24 Oct 2011 20:36:50 +0900, Tobias Gondrom<[email-masked]>  wrote:

---

From: "Anne van Kesteren" <[email-masked]>
Date: Tue, 25 Oct 2011 11:34:52 +0900

> Yes. If somebody has enough energy, it would still make sense to  

Because..?

---

From: "Martin J. Dürst" <[email-masked]>
Date: Tue, 25 Oct 2011 15:30:00 +0900

>> Yes. If somebody has enough energy, it would still make sense to

- Font formats, as well as other Mime types, are not only used by Web 
browsers.
- There may be new formats, for which no sniffing is done yet.
- Servers may prefer to declare what they are sending out rather than to 
be silent about it, even if not all clients use that information.
- Once we have registered types, sniffing could in the long term maybe 
even go away.

Regards,   Martin.

---

From: Tobias Gondrom <[email-masked]>
Date: Tue, 25 Oct 2011 07:42:33 +0100

On 25/10/11 07:30, "Martin J. Dürst" wrote:
> - Servers may prefer to declare what they are sending out rather than 
> to be silent about it, even if not all clients use that information.
+1 for that.
Tobias