Subject: RE: WebDAV and Open Pluggable Edge Services

From: "Clemm, Geoff" <[email-masked]>
Date: Wed, 20 Mar 2002 21:58:56 -0500

I agree with Roy that it doesn't make sense to talk about
authoring the results of a transformation, unless that transformation
is designed to be invertible, which is usually not the case.
In order for it to be suitable for authoring, the inversion would
have to send essential authoring metadata (such as locks) back
to the "actual" source.  About the only inversion that is likely
to be supported is effectively a link directly back to the actual
source (pretty much like what the DAV:source property would do).

Roy's point was not that edge services don't exist (obviously,
they do), but rather that authoring requests will not target the
results of the edge service, but will target the original source
that is the basis for what is produced by the edge service.
So it may be interesting to develop protocols for controlling and
requesting edge services, but this is largely orthogonal to the
distributed authoring issues that are the focus of WebDAV
(other than the need for a DAV:source property that jumps you
from the results of the edge service back to the appropriate source
resources). 

Cheers,
Geoff

-----Original Message-----
From: Lisa Dusseault [mailto:[email-masked]]
Sent: Wednesday, March 20, 2002 9:04 PM
To: 'Roy T. Fielding'
Cc: [email-masked]
Subject: RE: WebDAV and Open Pluggable Edge Services

I don't think you understand.  If I'm sitting inside a large company, trying
to author a page from a site that's out on the internet, that page may
already be subject to transformations from transparent edge services.  For
example, the company firewall may be filtering viruses downloaded via HTTP.
More insidious, if I get my internet service from a struggling ISP, they
could replace banner ads on incoming messages with their own banner ads.

The OPES WG at the IETF is dealing with these issues directly.  The IAB has
suggested that edge services should not be transparent -- that clients must
explicitly ask for edge services.  However, even an IETF demand for there
not to be transparent edge services isn't a guarantee that there won't be
any.  You could say that the authoring issues are an argument against
encouraging transparent edge services, but those issues certainly don't make
transparent edge services not exist.

Lisa

> -----Original Message-----
> From: Roy T. Fielding [mailto:[email-masked]]
> Sent: Wednesday, March 20, 2002 3:02 PM
> To: Lisa Dusseault
> Cc: [email-masked]
> Subject: Re: WebDAV and Open Pluggable Edge Services
>
>
> Authoring clients do not go through edge services, period.
> DAV clients
> always operate on the origin of content, not replications of
> it.  If an
> edge service (transformation configuration) itself is authorable, then
> it will be authored via a completely different authority than
> the resources
> that it transforms.
>
> ....Roy

---

From: "Jason Crawford" <[email-masked]>
Date: Thu, 21 Mar 2002 00:29:36 -0500

<<
2.  The situation could be made easier if all WebDAV clients were able to
include a header in GET requests indicating that the request is being made
by an authoring client, not a browsing client.  I suggest a header rather
than a method, because a new method will not be supported for much longer,
and won't interoperate with non-WebDAV servers.
But it doesn't deal with websites that simply serve sample code... or
anything else that might possibly trigger the transformations.  This
doesn't sound like a WebDAV specific issue.

2.5) Or... the server could specify that it not-be/be transformed with a
flag,
but this is not WebDAV specific again.

<<
3.  The source property is no help in this situation.  Doing a PROPFIND can
get you the source property, but then a GET to the URL in that property may
be subject to the same edge service transformations as the original URL.
Yup.  It doesn't hurt or help.

<<
4.  End-to-end encryption and/or signatures are the ultimate way to stop
edge services from transforming data.  Perhaps the spec coudl use a
recommendation that WebDAV servers SHOULD support TLS, and that WebDAV
clients SHOULD attempt to use TLS, even for content that is also available
unencrypted.  However, there are some unsolved issues here.  How does the
client discover that the content available over TLS is the same as the
content available over unsecured HTTP, in cases where the content doesn't
need to be secured by TLS for ordinary browsers?  Note that it's equally
possible for the server to host *different* content on ports 80 and 443, so
the client must be able to differentiate the two cases.
I have no problem with recommending TLS, but in regard to edge servers this
doesn't
sound like a webdav specific issue.  And WebDAV really isn't doing
anything odd or surprising that should require special consideration by
the OPES folks.  The OPES guys simply need to do the right thing.

Of course if someone see's it differently....  :-)

J.

------------------------------------------
Phone: 914-784-7569,   [email-masked]