Subject: Re: [APPS-REVIEW] Review of draft-merrick-jms-uri-05
From: Mark Baker <[email-masked]>
To: Harald Alvestrand <[email-masked]>
Cc: [email-masked], [email-masked], Lisa Dusseault <[email-masked]>, [email-masked], Eric Johnson <[email-masked]>, [email-masked]
Date: Tue, 24 Mar 2009 17:47:35 -0700
List-Id: Applications Review List <apps-review.ietf.org>

On Fri, Mar 20, 2009 at 11:05 PM, Harald Alvestrand
<[email-masked]> wrote:
> Thanks - those words help.
> The important point is that use of the URI depends on a shared context, and
> that context cannot be identified from the URI. Indeed, there may be valid
> cases where the same URI is resolvable in two different contexts, with two
> different results.
>
> That leaves me sad, because it is exactly opposite to what the "U" in "URI"
> sometimes stood for,

Me too 8-(

IMO this registration should be provisional, not permanent, because it
doesn't meet the requirements of sec 2.1 of RFC 4395;

   The use and deployment of new URI schemes in the Internet
   infrastructure is costly; some parts of URI processing may be
   scheme-dependent, and deployed software already processes URIs of
   well-known schemes.  Introducing a new URI scheme may require
   additional software, not only for client software and user agents but
   also in additional parts of the network infrastructure (gateways,
   proxies, caches) [11].  URI schemes constitute a single, global
   namespace; it is desirable to avoid contention over use of short,
   mnemonic scheme names.  For these reasons, the unbounded registration
   of new schemes is harmful.  New URI schemes SHOULD have clear utility
   to the broad Internet community, beyond that available with already
   registered URI schemes.

Mark.

Date: Sat, 21 Mar 2009 07:05:33 +0100
From: Harald Alvestrand <[email-masked]>
To: Eric Johnson <[email-masked]>
Cc: [email-masked], Lisa Dusseault <[email-masked]>, [email-masked], [email-masked], [email-masked]
Subject: Re: [APPS-REVIEW] Review of draft-merrick-jms-uri-05

Eric Johnson wrote:
> Hi Harald,
>
> Thank you for your feedback.  Sorry for the long delay in responding to you.
>
> The SOAP/JMS working group at the W3C has a response to all but one of
> your concerns, I think.  Those responses are noted below.
>
> Harald Alvestrand wrote:
>   
>> Document: draft-merrick-jms-uri-05
>> Reviewer: Harald Tveit Alvestrand
>> Type of review: Apps area review
>> Date: February 5, 2009
>>
>> Summary: This document is strange, but just about ready.
>>
>> This specification is highly unusual in that it really doesn't document
>> an URL for a protocol that can be resolved across the Internet - it
>> documents a way to describe the parameters that one should send across a
>> Java API.
>>
>> I think it a pity that the examples given give the impression that these
>> mechanisms are strictly local in scope - a "jndi name" of REQ_QUEUE, and
>> a "jndiURL" of file:/C:/JMSadmin both give the impression that these
>> URLs won't ever be resolvable outside of a quite local context.
>> I suspect that it is possible to construct JMS URLs that can be shared
>> globally with an expectation of uniform interpretation - if such exist,
>> it would be better for the document if they had been used in examples.
>>
>>     
>
> The answer is slightly more subtle - JMS URIs can span the globe, but
> that implies a shared context that also spans the globe.  I'm thinking
> that the following additional paragraph in the introduction might help
> to clarify:
>
> As a consequence of building upon an API, rather than a protocol, the
> utility of a "jms" URI depends on the context in which it is used.
> Critical details affecting utility include agreement on the same JMS
> provider or underlying protocol, agreement on the context for looking up
> endpoints, and when using serialized Java object messages, sufficiently
> similiar Java Class environments that the object can be appropriately
> read and written.  Uses of this scheme must establish the necessary
> shared context - a context which can span the globe, or merely a small
> local network.  With that shared context, this URI scheme enables
> endpoint identification in a uniform way, and the means to connect to
> those endpoints.
>   
Thanks - those words help.
The important point is that use of the URI depends on a shared context, 
and that context cannot be identified from the URI. Indeed, there may be 
valid cases where the same URI is resolvable in two different contexts, 
with two different results.

That leaves me sad, because it is exactly opposite to what the "U" in 
"URI" sometimes stood for, but it's a valid specifier choice. The added 
paragraph indeed makes it clearer.
>
>   
>> On the other hand, if this possibility does not exist, the document
>> should be very clear that these URIs are *not* possible to use in
>> Internet interchange without a prenegotiated context for interpretation,
>> and that they have no more global semantics than the "file:" URL scheme.
>>
>> Apart from that, the document seems to do its job of describing how to
>> pick apart one of these URLs and push the pieces through a Java API.
>> Some nits:
>>
>> - in section 4.1, some "shared" parameters are defined, but in section
>> 4, it says that new variants can be defined, whose parameters should
>> begin with the variant name as prefix (without specifying a separator
>> character). Is there an expectation that there will never be a variant
>> called "delivery", "time" or "priority"? If so, should this expectation
>> be documented? (what about the "del" variant? possible or not?)
>>
>>     
>
> I've been aware of this this point since we introduced the variants.  I
> see variants as so rare that this is essentially a moot issue.  In
> practice, I think there is at most one additional variant per vendor,
> and the market pressures are such that there will not be many
> implementations.
>   
Is there a reason to claim a registry for variants?
>
>   
>> - in section 4.2.1, it seems somewhat bizarre that the JNDI-specific
>> parameters all start with "jndi", while section 4.2.1.4 states that
>> additional JNDI-specific parameters should start wiht "jndi-" (note the
>> additional dash). Why not be uniform?
>>     
>
> We're still discussing this in the working group.  We've not settled on
> an answer because I think there multiple tensions here, such as between
> brevity and completeness, familiarity vs. convention, and so forth.
> We'll hopefully have a more complete answer soon.
>   
Good.
>   
>> - the fact that the URI needs to be in UTF-8 only surfaces in section 5,
>> long after the definition of the URI, and long after I'd started
>> wondering about it. I think it would be better if this section was moved
>> up  after section 3, just after the URI syntax is defined.
>>     
>
> There's a trade-off here.  We could move the entire section here up to
> be a sub-section of #3.  I think there's some value to having an top
> level-"encoding considerations" section called out in the TOC, and I
> don't see how we move that closer to the front.
>   
One way would be to place in #3 a note saying "The URIs are 
percent-encoded UTF-8. See section 5 for encoding considerations".
>
>   
>> The security section seems reasonably comprehensive - if one wants
>> additional review of this, it should be by someone who understands the
>> JMS and JNDI security models and can tell how they relate to this scheme
>> - this reviewer doesn't.
>>     
>
> Indeed!
>
> Thanks.
> -Eric Johnson.
>   

My pleasure. Good luck with getting the final details nailed!

Date: Fri, 20 Mar 2009 17:13:58 -0700
From: Eric Johnson <[email-masked]>
To: Harald Alvestrand <[email-masked]>
Cc: [email-masked], Lisa Dusseault <[email-masked]>, [email-masked], [email-masked], [email-masked]
Subject: Re: [APPS-REVIEW] Review of draft-merrick-jms-uri-05

Hi Harald,

Thank you for your feedback.  Sorry for the long delay in responding to you.

The SOAP/JMS working group at the W3C has a response to all but one of
your concerns, I think.  Those responses are noted below.

Harald Alvestrand wrote:
> Document: draft-merrick-jms-uri-05
> Reviewer: Harald Tveit Alvestrand
> Type of review: Apps area review
> Date: February 5, 2009
> 
> Summary: This document is strange, but just about ready.
> 
> This specification is highly unusual in that it really doesn't document
> an URL for a protocol that can be resolved across the Internet - it
> documents a way to describe the parameters that one should send across a
> Java API.
> 
> I think it a pity that the examples given give the impression that these
> mechanisms are strictly local in scope - a "jndi name" of REQ_QUEUE, and
> a "jndiURL" of file:/C:/JMSadmin both give the impression that these
> URLs won't ever be resolvable outside of a quite local context.
> I suspect that it is possible to construct JMS URLs that can be shared
> globally with an expectation of uniform interpretation - if such exist,
> it would be better for the document if they had been used in examples.
> 

The answer is slightly more subtle - JMS URIs can span the globe, but
that implies a shared context that also spans the globe.  I'm thinking
that the following additional paragraph in the introduction might help
to clarify:

As a consequence of building upon an API, rather than a protocol, the
utility of a "jms" URI depends on the context in which it is used.
Critical details affecting utility include agreement on the same JMS
provider or underlying protocol, agreement on the context for looking up
endpoints, and when using serialized Java object messages, sufficiently
similiar Java Class environments that the object can be appropriately
read and written.  Uses of this scheme must establish the necessary
shared context - a context which can span the globe, or merely a small
local network.  With that shared context, this URI scheme enables
endpoint identification in a uniform way, and the means to connect to
those endpoints.

> On the other hand, if this possibility does not exist, the document
> should be very clear that these URIs are *not* possible to use in
> Internet interchange without a prenegotiated context for interpretation,
> and that they have no more global semantics than the "file:" URL scheme.
> 
> Apart from that, the document seems to do its job of describing how to
> pick apart one of these URLs and push the pieces through a Java API.
> Some nits:
> 
> - in section 4.1, some "shared" parameters are defined, but in section
> 4, it says that new variants can be defined, whose parameters should
> begin with the variant name as prefix (without specifying a separator
> character). Is there an expectation that there will never be a variant
> called "delivery", "time" or "priority"? If so, should this expectation
> be documented? (what about the "del" variant? possible or not?)
> 

I've been aware of this this point since we introduced the variants.  I
see variants as so rare that this is essentially a moot issue.  In
practice, I think there is at most one additional variant per vendor,
and the market pressures are such that there will not be many
implementations.

> - in section 4.2.1, it seems somewhat bizarre that the JNDI-specific
> parameters all start with "jndi", while section 4.2.1.4 states that
> additional JNDI-specific parameters should start wiht "jndi-" (note the
> additional dash). Why not be uniform?

We're still discussing this in the working group.  We've not settled on
an answer because I think there multiple tensions here, such as between
brevity and completeness, familiarity vs. convention, and so forth.
We'll hopefully have a more complete answer soon.

> 
> - the fact that the URI needs to be in UTF-8 only surfaces in section 5,
> long after the definition of the URI, and long after I'd started
> wondering about it. I think it would be better if this section was moved
> up  after section 3, just after the URI syntax is defined.

There's a trade-off here.  We could move the entire section here up to
be a sub-section of #3.  I think there's some value to having an top
level-"encoding considerations" section called out in the TOC, and I
don't see how we move that closer to the front.

> 
> The security section seems reasonably comprehensive - if one wants
> additional review of this, it should be by someone who understands the
> JMS and JNDI security models and can tell how they relate to this scheme
> - this reviewer doesn't.

Indeed!

Thanks.
-Eric Johnson.