Subject: Re: [websec] [Ietf-message-headers] HTTP 'Origin' permanent and provisional

From: SM <[email-masked]>
Date: Wed, 13 Feb 2013 11:44:59 -0800

Hi Bjoern,

[Cc to Websec as it is their document]

At 09:37 13-02-2013, Bjoern Hoehrmann wrote:
>   http://www.iana.org/assignments/message-headers/prov-headers.html and
>http://www.iana.org/assignments/message-headers/perm-headers.html list
>the "Origin" header for HTTP, one per RFC 6454 and one from an earlier
>W3C registration. Is that as it should be?

No.  IANA did what it was requested to do.  Anyway, in my opinion, it 
would have to be fixed (process stuff).

Regards,
-sm

---

From: Julian Reschke <[email-masked]>
Date: Wed, 13 Feb 2013 21:12:19 +0100

On 2013-02-13 20:44, SM wrote:
> ...

Yes and no.

The core task is running the registries, and those really should be set 
up such that things like that simply can not happen. Seems like a 
software problem to me -- apparently there are two registries where 
there should be only one.

Best regards, Julian

---

From: Yoav Nir <[email-masked]>
Date: Wed, 13 Feb 2013 20:12:22 +0000

Hi SM

The W3C one is from a very old document, the first draft of which dates back to 2005. Anne van Kesteren has been editing it since 2007.

The Origin header was first mentioned in the draft from September 2008. There it is sully explained.
In 2009 the name of the document was changed to "Cross-Origin Resource Sharing".
Starting with the version from July 2010, that document references the WebSec draft, and later the RFC.

I suppose the provisional header should be removed, but the now-defunct W3C group is no longer available to request this.

I'll see what can be done.

Yoav

On Feb 13, 2013, at 9:44 PM, SM <[email-masked]>
 wrote:

> No.  IANA did what it was requested to do.  Anyway, in my opinion, it would have to be fixed (process stuff).
> 
> Regards,
> -sm
> 
> 
> 
> 
> _______________________________________________
> websec mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/websec
> 
> Email secured by Check Point

---

From: Julian Reschke <[email-masked]>
Date: Wed, 13 Feb 2013 21:24:15 +0100

> I'll see what can be done.

Well.

You make it sound as if it's ok to run two different registries with 
partly overlapping values. It's not. It's a bug in the way IANA handles 
this. This is what needs to be fixed.

Best regards, Julian

---

From: Barry Leiba <[email-masked]>
Date: Wed, 13 Feb 2013 15:30:58 -0500

> You make it sound as if it's ok to run two different registries with partly
> overlapping values. It's not. It's a bug in the way IANA handles this. This
> is what needs to be fixed.

Indeed.  I've already suggested to Yoav, off list, how to get this
fixed in this case.

I will talk with IANA in Orlando about dealing with it systematically.

Barry, Applications AD

---

From: SM <[email-masked]>
Date: Wed, 13 Feb 2013 12:32:12 -0800

Hi Julian,
At 12:24 13-02-2013, Julian Reschke wrote:
>partly overlapping values. It's not. It's a bug in the way IANA 
>handles this. This is what needs to be fixed.

It's easier to fix the bug first.

The following could be used:

   "When a new entry is recorded in the permanent message header field
    registry, IANA will remove any corresponding entries (with the same
    field name and protocol) from the provisional registry."

That avoids overlapping values.

Regards,
-sm

---

From: Yoav Nir <[email-masked]>
Date: Wed, 13 Feb 2013 20:43:18 +0000

On Feb 13, 2013, at 10:24 PM, Julian Reschke <[email-masked]>
 wrote:

> Well.
> 
> You make it sound as if it's ok to run two different registries with partly overlapping values. It's not. It's a bug in the way IANA handles this. This is what needs to be fixed.
> 
> Best regards, Julian

I don't want to turn this into a process debate, but having a provisional registry like this allows you to create interoperable implementations while the document is still at draft. I often see a push to get a document published because we need the IANA assignments for products. 

Of course they could still do this with a single registry where provisional entries are somehow marked (with an asterisk?). That way we wouldn't get to a situation where we have double entries.

Yoav

---

From: Julian Reschke <[email-masked]>
Date: Wed, 13 Feb 2013 21:54:19 +0100

> I don't want to turn this into a process debate, but having a provisional registry like this allows you to create interoperable implementations while the document is still at draft. I often see a p…

Yes.

> Of course they could still do this with a single registry where provisional entries are somehow marked (with an asterisk?). That way we wouldn't get to a situation where we have double entries.

The key thing being that both registries share the same namespace, so, 
by definition, an entry can not appear in both. If it does, there's a 
process/software problem.

Of course the trivial way to do this right is to implement a *single* 
registry, and to just store a flag for each entry.

Best regards, Julian

---

From: Mark Nottingham <[email-masked]>
Date: Thu, 14 Feb 2013 16:04:34 +1100

We've been talking for a while about revising 3864; it needs a lot more than this done.

Cheers,

On 14/02/2013, at 7:54 AM, Julian Reschke <[email-masked]> wrote:

> The key thing being that both registries share the same namespace, so, by definition, an entry can not appear in both. If it does, there's a process/software problem.
> 
> Of course the trivial way to do this right is to implement a *single* registry, and to just store a flag for each entry.
> 
> Best regards, Julian
> 
> Ietf-message-headers mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ietf-message-headers

--
Mark Nottingham   http://www.mnot.net/

---

From: Julian Reschke <[email-masked]>
Date: Thu, 14 Feb 2013 08:57:00 +0100

> We've been talking for a while about revising 3864; it needs a lot more than this done.

True, but the issue applies to all registries that are split into 
categories.

Best regards, Julian

---

From: Bjoern Hoehrmann <[email-masked]>
Date: Thu, 14 Feb 2013 19:18:50 +0100

* Graham Klyne wrote:
>On 13/02/2013 20:32, SM wrote:
>Just for the record:
>   http://www.rfc-editor.org/rfc/rfc3864.txt, section 4.3

Excellent. I gave up grepping for "same" after the first couple of hits.
I agree that Graham should just go ahead and ask IANA to remove the re-
dundant entry (I'd have done that, copying ietf-message-headers, had I
found the text above).
-- 
Björn Höhrmann · mailto:[email-masked] · http://bjoern.hoehrmann.de
Am Badedeich 7 · Telefon: +49(0)160/4415681 · http://www.bjoernsworld.de
25899 Dagebüll · PGP Pub. KeyID: 0xA4357E78 · http://www.websitedev.de/

---

From: Graham Klyne <[email-masked]>
Date: Thu, 14 Feb 2013 16:07:21 +0000

On 13/02/2013 20:32, SM wrote:
>> overlapping values. It's not. It's a bug in the way IANA handles this. This is
>> what needs to be fixed.
>

Just for the record:

#g