attachment
<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Hi Ira,<div class=""><br class=""></div><div class="">As you suggested, I've added the IPP Workgroup reflector to the list of recipients to bring this sidebar discussion into the forum without having to start from scratch.</div><div class=""><br class=""></div><div class=""><blockquote type="cite" class=""><div dir="ltr" class=""><div class="">I do agree that it's not desirable that IPP Infrastructure Printers should <br class=""></div><div class="">accept anything except Get-Printers w/out TLS security.<br class=""></div></div></blockquote><div class=""><div dir="ltr" class=""><div class=""><br class=""></div><div class="">If an Infrastructure Printer object is supposed to be available on the Internet but for "private use only", how does that work given the legacy Get-Printer-Attributes use precedent? What should the response be from the "System Service" or other process actually hosting the IPP Printer object? HTTP 404? Or an IPP layer equivalent? I'm not sure we ever considered this use case in 5100.18.</div><div class=""><br class=""></div><div class=""><div class="">At the very least, we need to have a statement / paper prepared that provides guidance to Infrastructure Printer implementors to the critique that a Get-Printer-Attributes does not constitute either a security or a privacy risk. If each cloud / Infrastructure Printer hosting provider does something different, that makes it very difficult for client implementations to support in any consistent way. </div></div><div class=""><br class=""></div><div class="">Thoughts?</div><div class=""><br class=""></div></div></div><div class=""><div class="">
Smith<br class=""><br class="">/**<br class=""> Smith Kennedy<br class=""> HP Inc.<br class="">*/
</div>
<div><br class=""><blockquote type="cite" class=""><div class="">On Nov 11, 2021, at 6:49 PM, Ira McDonald <<a href="mailto:blueroofmusic@gmail.com" class="">blueroofmusic@gmail.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><meta http-equiv="Content-Type" content="text/html; charset=utf-8" class=""><div dir="ltr" class=""><div class="">Hi,</div><div class=""><br class=""></div><div class="">+1 to future discussion in IPP Implementors Guide.</div><div class=""><br class=""></div><div class="">+1 to near-term discussion in Enterprise Printing Extensions. <br class=""></div><div class=""><br class=""></div><div class="">+1 to also saying something in IPP 2.x 4th Edition.</div><div class=""><br class=""></div><div class="">I suggest we should take this topic to the IPP WG mailing list.</div><div class=""><br class=""></div><div class="">I do agree that it's not desirable that IPP Infrastructure Printers should <br class=""></div><div class="">accept anything except Get-Printers w/out TLS security.<br class=""></div><div class=""><br class=""></div><div class="">Cheers,</div><div class="">- Ira</div><div class=""><br class=""></div><div class=""><div class=""><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr" class=""><div class=""><div dir="ltr" class=""><div class=""><div dir="ltr" class=""><div class=""><div dir="ltr" class=""><div class=""><div dir="ltr" class=""><div class=""><div dir="ltr" class=""><div class=""><div dir="ltr" class=""><div class=""><div dir="ltr" class=""><div class=""><div dir="ltr" class=""><i class=""><font size="1" class="">Ira McDonald (Musician / Software Architect)</font></i></div><div class=""><i class=""><font size="1" class="">Chair - SAE Trust Anchors and Authentication TF<br class=""></font></i></div><div dir="ltr" class=""><i class=""><font size="1" class="">Co-Chair - TCG Trusted Mobility Solutions WG</font></i></div><div class=""><i class=""><font size="1" class="">Co-Chair - TCG Metadata Access Protocol SG<br class=""></font></i></div><div dir="ltr" class=""><i class=""><font size="1" class="">Chair - Linux Foundation Open Printing WG<br class="">Secretary - IEEE-ISTO Printer Working Group<br class="">Co-Chair - IEEE-ISTO PWG Internet Printing Protocol WG<br class="">IETF Designated Expert - IPP & Printer MIB<br class="">Blue Roof Music / High North Inc<br class=""><a style="color:rgb(51,51,255)" href="http://sites.google.com/site/blueroofmusic" target="_blank" class="">http://sites.google.com/site/blueroofmusic</a><br class=""><a style="color:rgb(102,0,204)" href="http://sites.google.com/site/highnorthinc" target="_blank" class="">http://sites.google.com/site/highnorthinc</a><br class="">mailto: <a href="mailto:blueroofmusic@gmail.com" target="_blank" class="">blueroofmusic@gmail.com</a><br class="">(permanent) PO Box 221 Grand Marais, MI 49839 906-494-2434</font></i></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div><br class=""></div></div><br class=""><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Nov 10, 2021 at 11:08 PM Kennedy, Smith (Wireless & IPP Standards) <<a href="mailto:smith.kennedy@hp.com" class="">smith.kennedy@hp.com</a>> wrote:<br class=""></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><br class="">
<br class="">
> On Nov 10, 2021, at 6:10 PM, Michael Sweet <<a href="mailto:msweet@msweet.org" target="_blank" class="">msweet@msweet.org</a>> wrote:<br class="">
> <br class="">
> Smith,<br class="">
> <br class="">
> It isn't so much explicitly disallowing it, it is just that Get-Printer-Attributes is the only operation in STD92 that doesn't talk about access rights and historically no implementation has ever required authentication for it. As a result, no client supports authentication when querying printer status/capabilities with Get-Printer-Attributes...<br class="">
<br class="">
Wow, I am surprised that I didn't have this committed to memory. 😞 That makes it pretty awkward to cite from a normative / testing point of view. I really think somewhere needs to overtly state this. Maybe IPP/2.0 Fourth Edition? I also think this should be discussed more clearly in the IPP IG and maybe in Enterprise Printing Extensions which now hosts the definition of Get-User-Printer-Attributes.<br class="">
<br class="">
> <br class="">
> <br class="">
>> On Nov 10, 2021, at 6:17 PM, Kennedy, Smith (Wireless & IPP Standards) <<a href="mailto:smith.kennedy@hp.com" target="_blank" class="">smith.kennedy@hp.com</a>> wrote:<br class="">
>> <br class="">
>> I was being asked which specific clause in a PWG or IETF IPP spec actually made that assertion. I was unable to locate it. 😞 Can you point out the clause in one of our specs that specifically disallows authentication with Get-Printer-Attributes?<br class="">
>> <br class="">
>> For an infrastructure printer, it really doesn’t seem unreasonable for the Printer to require authentication for all IPP operations, including Get-Printer-Attributes. I suppose that could cause problems with legacy clients. But that seems to leave the door open to abuse or at least misunderstanding by “security researchers”.<br class="">
<br class="">
Any comments or thoughts on this? I wonder if we ought to have 5100.18 v1.1 say that the unauthenticated Get-Printer-Attributes should limit the attributes it provides.<br class="">
<br class="">
>> <br class="">
>> Cheers,<br class="">
>> Smith<br class="">
>> ---<br class="">
>> Smith Kennedy<br class="">
>> <a href="mailto:smith.kennedy@hp.com" target="_blank" class="">smith.kennedy@hp.com</a><br class="">
>> <br class="">
>> <br class="">
>>> On Nov 10, 2021, at 3:42 PM, Michael Sweet <<a href="mailto:msweet@msweet.org" target="_blank" class="">msweet@msweet.org</a>> wrote:<br class="">
>>> <br class="">
>>> Smith,<br class="">
>>> <br class="">
>>> The "rules" are the same for Cloud vs. local - all operations *except* Get-Printer-Attributes/Get-System-Attributes can require authentication. The Get operations are exempt because they are the only way to discover what the authentication requirements are... :)<br class="">
>>> <br class="">
>>> <br class="">
>>>> On Nov 10, 2021, at 4:57 PM, Kennedy, Smith (Wireless & IPP Standards) <<a href="mailto:smith.kennedy@hp.com" target="_blank" class="">smith.kennedy@hp.com</a>> wrote:<br class="">
>>>> <br class="">
>>>> Hi there,<br class="">
>>>> <br class="">
>>>> If you have a "cloud" printer, is it "OK" to have the cloud Printer (Infrastructure Printer) require authentication for ALL IPP operations?<br class="">
>>>> <br class="">
>>>> I'm trolling through 8011 and 5100.18 to see if I can find language on the subject but if either of you know that would be helpful.<br class="">
>>>> <br class="">
>>>> Smith<br class="">
>>>> <br class="">
>>>> /**<br class="">
>>>> Smith Kennedy<br class="">
>>>> HP Inc.<br class="">
>>>> */<br class="">
>>>> <br class="">
>>> <br class="">
>>> ________________________<br class="">
>>> Michael Sweet<br class="">
>>> <br class="">
>>> <br class="">
>>> <br class="">
> <br class="">
> ________________________<br class="">
> Michael Sweet<br class="">
> <br class="">
> <br class="">
> <br class="">
<br class="">
</blockquote></div>
</div></blockquote></div><br class=""></div></div></body></html>