attachment
<div dir="ltr"><div>Hi Mike,</div><div><br></div><div>Yes, I agree with this basic security improvement as a RECOMMENDATION.</div><div><br></div><div>Cheers,</div><div>- Ira<br></div><div><div><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr">Ira McDonald (Musician / Software Architect)<br>Co-Chair - TCG Trusted Mobility Solutions WG<br>Chair - Linux Foundation Open Printing WG<br>Secretary - IEEE-ISTO Printer Working Group<br>Co-Chair - IEEE-ISTO PWG Internet Printing Protocol WG<br>IETF Designated Expert - IPP & Printer MIB<br>Blue Roof Music / High North Inc<br><a style="color:rgb(51,51,255)" href="http://sites.google.com/site/blueroofmusic" target="_blank">http://sites.google.com/site/blueroofmusic</a><br><a style="color:rgb(102,0,204)" href="http://sites.google.com/site/highnorthinc" target="_blank">http://sites.google.com/site/highnorthinc</a><br>mailto: <a href="mailto:blueroofmusic@gmail.com" target="_blank">blueroofmusic@gmail.com</a><br>Jan-April: 579 Park Place Saline, MI 48176 734-944-0094<br>May-Dec: PO Box 221 Grand Marais, MI 49839 906-494-2434<br><br><div style="display:inline"></div><div style="display:inline"></div><div style="display:inline"></div><div></div><div></div><div></div><div></div></div></div></div></div></div><br></div></div><br><div class="gmail_quote"><div dir="ltr">On Thu, Aug 23, 2018 at 9:46 AM Michael Sweet <<a href="mailto:msweet@apple.com">msweet@apple.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">All,<br>
<br>
I've had some recent discussions internally at Apple concerning some network management issues with IPP printers that serve their resource files over a different port (typically port 80) than their IPP endpoint. Basically, it is "easy" to whitelist communications over port 631 (or 443, as is still often the case) for IPP but less desirable to whitelist port 80 which is also used for web content.<br>
<br>
Effectively this means that we'd like to see printers advertise their printer-icc-profiles, printer-icons, printer-more-info, printer-strings-uri, and printer-supply-info-uri URLs with the same host and port as in printer-uri-supported and printer-xri-supported, which is supposed to match the HTTP Host header. We can't make this a requirement in IPP Everywhere v1.1, but I'd like to add it as an explicit recommendation (Printers SHOULD ...) in sections 5.3 and 5.4, and note that the port number should also be included in section 5.1.1 which talks about using the HTTP Host header value.<br>
<br>
I also notice that printer-more-info should be listed as a Printer Status attribute and we need to add the missing printer-strings-uri and printer-strings-languages-supported attributes as RECOMMENDED...<br>
<br>
Thoughts?<br>
<br>
_________________________________________________________<br>
Michael Sweet, Senior Printing System Engineer<br>
<br>
_______________________________________________<br>
ipp mailing list<br>
<a href="mailto:ipp@pwg.org" target="_blank">ipp@pwg.org</a><br>
<a href="https://www.pwg.org/mailman/listinfo/ipp" rel="noreferrer" target="_blank">https://www.pwg.org/mailman/listinfo/ipp</a><br>
</blockquote></div>