Subject: draft-duerst-iana-namespace-00.txt

From: Tony Finch <[email-masked]>
Date: Sun, 2 Mar 2008 20:50:58 +0000

The latest RISKS gibes an example of the magnitude of the problem of
unwanted traffic caused by using URLs instead of URNs for protocol
identification URIs. Perhaps the security considerations section of the
draft should describe some ways of mitigating it?

http://catless.ncl.ac.uk/Risks/25.07.html#subj9

Tony.
-- 
f.a.n.finch  <[email-masked]>  http://dotat.at/
TYNE DOGGER FISHER GERMAN BIGHT HUMBER THAMES: WESTERLY 6 TO GALE 8. ROUGH OR
VERY ROUGH. SQUALLY WINTRY SHOWERS. MODERATE OR GOOD.
_______________________________________________
IETF mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ietf

---

From: Julian Reschke <[email-masked]>
Date: Sun, 02 Mar 2008 21:54:12 +0100

> http://catless.ncl.ac.uk/Risks/25.07.html#subj9

I think this is a misunderstanding.

The URI of a DTD is needed to fetch the DTD. The W3C suffers from 
clients that refetch the DTD all the time.

Contrary to that, XML processors do not resolve namespace URIs, they are 
purely used as identifiers.

BR, Julian

---

From: Ned Freed <[email-masked]>
Date: Sun, 02 Mar 2008 15:23:06 -0800 (PST)

> purely used as identifiers.

That's certainly how things are supposed to work. It may or may not be how they
actually work.

Some years back one of my email addresses ended up in a few of the headers of a
MIME test message corpus. This corpus isn't part of any standard and was never
widely promoted, and there's no obvious path by which an address in a test
message header would or should be replied to. Yet the fact remains that over
the years I've received hundreds of bogus responses as a result of this
inclusion.

The bottom line is that if something is syntactically usable people will screw
up and use it; the only question is how often. For example, I could easily see
some bit of code being written that attempts to resolve anything that looks
like a URL no matter what context it appears in.

Now, maybe in this case it won't happen often enough to matter. I certainly
hope that's the case. But one of the things we're supposed to do here is try
and antipicate possible difficulties, and given past history I think some
concern is warranted.

				Ned

---

From: "Tim Bray" <[email-masked]>
Date: Sun, 2 Mar 2008 17:49:37 -0800

>  That's certainly how things are supposed to work. It may or may not be how they

I agree with Ned that the Security considerations or some other piece
of the doc should explicitly cover this issue.  -Tim
_______________________________________________
IETF mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ietf

---

From: Julian Reschke <[email-masked]>
Date: Mon, 03 Mar 2008 09:05:06 +0100

> of the doc should explicitly cover this issue.  -Tim

In the meantime, one could ask the W3C whether they see a lot of traffic 
on popular namespace URIs, such as XHTML, XSLT or Atom.

BR, Julian

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Mon, 3 Mar 2008 12:21:16 +0100

On Sun, Mar 02, 2008 at 08:50:58PM +0000,
 Tony Finch <[email-masked]> wrote 
 a message of 16 lines which said:

> The latest RISKS gibes an example 

The actual original reference is:

http://www.w3.org/blog/systeam/2008/02/08/w3c_s_excessive_dtd_traffic

> Perhaps the security considerations section of the draft should
> describe some ways of mitigating it?

Yes. I suggest (continuing the first paragraph of section 7):

On the client side, implementors MUST use the existing solutions to
limit the rate of access to the origin server. They include:

* ability to use HTTP caching ([RFC 2616], section 13)
* local storage of data, together with HTTP headers like
  If-Modified-Since ([RFC 2616], section 14.25)
* XML catalogs ([OASIS 2001]) 

On the server side, server managers should be aware that some clients
will not play nice, as described in [W3C 2008]. Server managers should
be prepared to use measures such as rate-limiting as well as IP
blacklisting of the worse offenders.

[W3C 2008] W3C's Excessive DTD Traffic. Ted
Guild. <http://www.w3.org/blog/systeam/2008/02/08/w3c_s_excessive_dtd_traffic>

[OASIS 2001] XML Catalogs Committee Specification 06 Aug 2001. Ed.:
Norman Walsh.
<http://www.oasis-open.org/committees/entity/spec-2001-08-06.html>

---

From: Ned Freed <[email-masked]>
Date: Mon, 03 Mar 2008 06:38:00 -0800 (PST)

> on popular namespace URIs, such as XHTML, XSLT or Atom.

By all means do so if you want, but IMO it's a waste of time. It's like that
cautionary line finance folks use: Past performance is not a reliable
indication of future results. Just because someone group of implementors got it
right (or wrong) in the past doesn't mean the next group won't get it wrong (or
right) this time. What such a query is effectively trying to do is to prove a
negative. Good luck with that.

Again, the bottom line is that the potential for a screwup is there and past
experience tells us that the potential is sometimes, um, exploited, sometimes
not. And that's more than sufficient to warrant discussion of the issue  in the
document.

				Ned

---

From: Julian Reschke <[email-masked]>
Date: Mon, 03 Mar 2008 16:02:33 +0100

> not. And that's more than sufficient to warrant discussion of the issue  

Let me rephrase it then: as far as I know, there is no evidence 
whatsoever that using an HTTP based URI as an XML namespace name so far 
has caused excessive traffic.

I would argue that those who argue against their use will have to 
provide such evidence.

And yes, having the specification *warning* against automatic retrieval 
is always a good idea (see, for instance, 
<http://greenbytes.de/tech/webdav/rfc3648.html#rfc.section.11.1>).

BR, Julian

---

From: Julian Reschke <[email-masked]>
Date: Mon, 03 Mar 2008 17:00:54 +0100

Stephane Bortzmeyer wrote:
> ...
> ...

Hm, we are talking about XML namespace names, not DTD URIs.

XML processors are not supposed to resolve them, so it seems strange to 
insert requirements for clients that do so.

 > ...

BR, Julian

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Mon, 3 Mar 2008 17:07:55 +0100

On Mon, Mar 03, 2008 at 05:00:54PM +0100,
 Julian Reschke <[email-masked]> wrote 

> Hm, we are talking about XML namespace names, not DTD URIs.

I do not see the difference. XML catalogs, for instance, are also
explicitely made for XML namespace names.
 
But, OK, we could modify my suggestion that way:

On the client side, <new>if the software processing the document
retrieves the resource indicated by the namespace name, something
which is never mandatory</new>, implementors MUST use the existing
solutions to limit the rate of access to the origin server.
_______________________________________________
IETF mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ietf

---

From: "Tom.Petch" <[email-masked]>
Date: Tue, 4 Mar 2008 16:39:49 +0100

----- Original Message -----
From: "Julian Reschke" <[email-masked]>
To: "Stephane Bortzmeyer" <[email-masked]>
Cc: "Tony Finch" <[email-masked]>; <[email-masked]>
Sent: Monday, March 03, 2008 5:00 PM
Subject: Re: draft-duerst-iana-namespace-00.txt

> insert requirements for clients that do so.
Welcome as this is, why is this I-D limited to XML namespace names?  What about
XML Schema names?

And is this not an update to RFC3688?

Tom Petch

---

From: Julian Reschke <[email-masked]>
Date: Tue, 04 Mar 2008 18:16:54 +0100

> Welcome as this is, why is this I-D limited to XML namespace names?  What about

Pardon my ignorance, but what is an XML Schema name? I

> And is this not an update to RFC3688?

I'd consider it an alternative approach.

BR, Julian

---

From: "Frank Ellermann" <[email-masked]>
Date: Tue, 4 Mar 2008 19:03:16 +0100

Julian Reschke wrote:

> Pardon my ignorance, but what is an XML Schema name?

No pardon, but a guess s/name/location/ as in:

 xmlns:use="http://www.w3.org/2001/XMLSchema-instance"
 use:schemaLocation="http://www.sitemaps.org/schemas/sitemap/0.9  http://www.sitemaps.org/schemas/sitemap/0.9/siteindex.xsd"

 Frank

---

From: "Tom.Petch" <[email-masked]>
Date: Tue, 4 Mar 2008 19:06:42 +0100

----- Original Message -----
From: "Julian Reschke" <[email-masked]>
To: "Tom.Petch" <[email-masked]>
Cc: "Stephane Bortzmeyer" <[email-masked]>; "ietf" <[email-masked]>
Sent: Tuesday, March 04, 2008 6:16 PM
Subject: Re: draft-duerst-iana-namespace-00.txt

> Pardon my ignorance, but what is an XML Schema name? I

As defined in RFC3688, which sets up  namespaces for
 XML namespaces
 XML schema
 XML rdfschema
 XML publicid
all using the URI scheme urn:

Tom Petch

---

From: Julian Reschke <[email-masked]>
Date: Wed, 05 Mar 2008 09:16:09 +0100

> all using the URI scheme urn:

OK.

The registries for rdfschema is unused, the one for publicid only 
contains a single entry for a legacy (1997) version of HTML.

The XML schema registry is just an indirection layer for retrieval of 
XML Schema files (XSDs); this is why I was confused by "Schema name".

So, back to why the proposal doesn't cover XML Schema? I guess because

1) nobody asked for it, and

2) contrary to XML namespace names, XML processors *are* known to 
retrieve XSD files, so it indeed might be a bad idea to introduce a 
single point of failure here.

BR, Julian

---

From: Ned Freed <[email-masked]>
Date: Wed, 05 Mar 2008 09:30:58 -0800 (PST)

> has caused excessive traffic.

I'm well aware of that but IMO it isn't especially relevant.

> I would argue that those who argue against their use will have to

That might be a legitimate argument if there was no past history of this sort
of stupidity in other contexts. Sadly, that's not the case, and that renders
your argument invalid. An essential component of sound engineering is
anticipation of problems in a particular context that haven't happened before,
and one of the main ways we do this is by looking at issues that have arisen in
similar but not identical contexts.

> <http://greenbytes.de/tech/webdav/rfc3648.html#rfc.section.11.1>).

Then it seems we're in agreement as to what the minimum is that needs to be
done, so this will be my final message on this topic.

				Ned

---

From: "Frank Ellermann" <[email-masked]>
Date: Wed, 5 Mar 2008 19:03:47 +0100

> contains a single entry for a legacy (1997) version of HTML.

In theory the RFC 2629 DTD should be added.  In practice a bad
idea, because this DTD is still a moving target.  The CharmapML
DTDs could be candidates, if Unicode wants "public identifiers"
and puts them into an IETF RFC (in essence for write access on
the IANA registry).

AFAIK there's no resolver for the URNs, it's all about public
identifiers.  Users wishing to support them have to fetch the
DTDs (in this case) "manually" from IANA.

 Frank