Subject: [dispatch] Registration of "hxxp" URI scheme

From: Hugo Salgado-Hernández <[email-masked]>
Date: Fri, 5 May 2017 12:53:26 -0300

Dear dispatch WG.
I recently realized there's no registration for the "hxxp"
scheme in the IANA table. This scheme had become a de-facto
standard from many years, inside the security community,
to obfuscate malicious urls. I think it deserves to be
registered for block and documentation matters.

I wrote a short draft but I'm not sure of the path forward.
I know I can ask for a "provisional" registration, but I can't
find any description or document to point as a reference. So
maybe will be an opportunity to publish an spec as an
Informational RFC and point to it, being a provisional or
permanent registration.

Draft is here
  https://datatracker.ietf.org/doc/draft-salgado-hxxp/

What do you think?

Best,

Hugo

---

From: "John Levine" <[email-masked]>
Date: 5 May 2017 16:17:48 -0000

In article <[email-masked]> you write:
>-=-=-=-=-=-

Since the whole point of hxxp is to prevent interoperation, I don't
understand what problem a permanent registration would solve.  It
doesn't seem very likely that anyone would use those four letters to
mean anything else. but if you want a placeholder to prevent that, a
provisional FCFS registration would do the trick.

R's,
John

---

From: Mark Nottingham <[email-masked]>
Date: Mon, 8 May 2017 13:33:00 +1000

I think it's worth having a registry entry if this is widespread practice, if only to prevent accidental use.

I agree that a provisional registration would do that. 

Cheers,

> On 6 May 2017, at 2:17 am, John Levine <[email-masked]> wrote:
> 
> _______________________________________________
> dispatch mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dispatch

--
Mark Nottingham   https://www.mnot.net/

---

From: Hugo Salgado-Hernández <[email-masked]>
Date: Tue, 9 May 2017 22:39:32 -0300

Thanks John and Mark.
Fair enough. I've asked and received the provisional registration,
with the draft as reference. In case its needed, it can be upgraded
to permanent in the future.

Hugo

---

From: "John Levine" <[email-masked]>
Date: 10 May 2017 02:21:08 -0000

You might as well grab hxxps too.

R's,
John

>[Attachment type=application/pgp-signature, name=signature.asc]
>-=-=-=-=-=-

---

From: Cullen Jennings <[email-masked]>
Date: Thu, 11 May 2017 17:08:41 -0700

It sounds like this has dispatched itself so from a chair point of view, I don't think we need to do much more here. Let us know if you think we need to so something else.

Thanks, Cullen (one of the chairs)

> On May 9, 2017, at 7:21 PM, John Levine <[email-masked]> wrote:
>