BIP21 bitcoin URIs and HTML5
6 messages, 24 Apr to 2 May 2013. Started by Mike Hearn.
Mike Hearn (2), Andreas Schildbach, Gavin Andresen, Melvin Carvalho, Greg Maxwell
HTML5 allows web apps to register themselves for handling URI schemes, such as the bitcoin: URI that is already in use and being extended as part of the payment protocol.
The bad news is that for security reasons there is a whitelist of acceptable schemes in the spec:
The good news is that yesterday I talked to Hixie about it and he added bitcoin to the whitelist:
http://html5.org/tools/web-apps-tracker?from=7849&to=7850
I'm currently finding out what the process is for browser makers to notice the change (perhaps they watch the spec commit history and nothing needs to be done), but within a few months most users should have browsers that can accept bitcoin as a web-app handleable protocol scheme. I suppose IE10 users may be the laggards, but I guess we can live with that for now.
Ian pointed out some errors in the BIP21 spec. What's the process for amending the BIP? Do we need to create a new one and mark the old one as replaced, or can we just fix it in place given the relatively exotic nature of most of the issues? Here's his feedback:
- BNF doesn't say what it's character set is (presumably it's Unicode)
- "bitcoinparams" production doesn't define the separator, so in theory the syntax is ...?label=foomessage=fooother=foo (rather than ...?label=foo&message=foo etc)
- the syntax allows ?amount=FOO&amount=1.1 as far as I can tell, since "otherparam" matches any name followed by any value, including "amount" followed by a bogus value.
- "pchar" is referenced without definition.
- the "simpler" syntax is just wrong (it would result in bitcoin:address?amount=1?label=FOO rather than bitcoin:address?amount=1&label=FOO)
BTW the IETF URL specs are being obsoleted by http://url.spec.whatwg.org/, at least for Web purposes. In that case matters.
I had another amendment, which roughly (can't remember the details) has to do with case-sensitivity of the scheme part and parameter names. If I remember right, BITCOIN:1d4...?AMOUNT=0.1 would be a correct URI but not valid in the sense of BIP21 currently.
On 04/24/2013 09:42 AM, Mike Hearn wrote:
Quoted text (63 lines)
> HTML5 allows web apps to register themselves for handling URI schemes, > such as the bitcoin: URI that is already in use and being extended as > part of the payment protocol. > > The bad news is that for security reasons there is a whitelist of > acceptable schemes in the spec: > > http://www.whatwg.org/specs/web-apps/current-work/multipage/timers.html#dom-navigator-registerprotocolhandler > > The good news is that yesterday I talked to Hixie about it and he added > bitcoin to the whitelist: > > http://html5.org/tools/web-apps-tracker?from=7849&to=7850 > > I'm currently finding out what the process is for browser makers to > notice the change (perhaps they watch the spec commit history and > nothing needs to be done), but within a few months most users should > have browsers that can accept bitcoin as a web-app handleable protocol > scheme. I suppose IE10 users may be the laggards, but I guess we can > live with that for now. > > Ian pointed out some errors in the BIP21 spec. What's the process for > amending the BIP? Do we need to create a new one and mark the old one as > replaced, or can we just fix it in place given the relatively exotic > nature of most of the issues? Here's his feedback: > > > - BNF doesn't say what it's character set is (presumably it's Unicode) > > - "bitcoinparams" production doesn't define the separator, so in theory > the syntax is ...?label=foomessage=fooother=foo (rather than > ...?label=foo&message=foo etc) > > - the syntax allows ?amount=FOO&amount=1.1 as far as I can tell, since > "otherparam" matches any name followed by any value, including "amount" > followed by a bogus value. > > - "pchar" is referenced without definition. > > - the "simpler" syntax is just wrong (it would result in > bitcoin:address?amount=1?label=FOO rather > than bitcoin:address?amount=1&label=FOO) > > BTW the IETF URL specs are being obsoleted > by http://url.spec.whatwg.org/, at least for Web purposes. In that case > matters. > > > > ------------------------------------------------------------------------------ > Try New Relic Now & We'll Send You this Cool Shirt > New Relic is the only SaaS-based application performance monitoring service > that delivers powerful full stack analytics. Optimize and monitor your > browser, app, & servers with just a few lines of code. Try New Relic > and get this awesome Nerd Life shirt! http://p.sf.net/sfu/newrelic_d2d_apr > > > > _______________________________________________ > Bitcoin-development mailing list > Bitcoin-development@lists•sourceforge•net > https://lists.sourceforge.net/lists/listinfo/bitcoin-development >
Quoted text (1 line)
> Ian pointed out some errors in the BIP21 spec. What's the process for
amending the BIP? Do we need to create a new one and mark the old one as replaced, or can we just fix it in place given the relatively exotic nature of most of the issues?
Those all sound like bugs in the BIP; I think they should just be fixed, I don't think we need a new BIP.
I vote for a new meta-data item in the BIP header:
Corrected: <date>
On 24 April 2013 09:42, Mike Hearn <mike@plan99•net> wrote:
Quoted text (21 lines)
> HTML5 allows web apps to register themselves for handling URI schemes, > such as the bitcoin: URI that is already in use and being extended as part > of the payment protocol. > > The bad news is that for security reasons there is a whitelist of > acceptable schemes in the spec: > > > http://www.whatwg.org/specs/web-apps/current-work/multipage/timers.html#dom-navigator-registerprotocolhandler > > The good news is that yesterday I talked to Hixie about it and he added > bitcoin to the whitelist: > > http://html5.org/tools/web-apps-tracker?from=7849&to=7850 > > I'm currently finding out what the process is for browser makers to notice > the change (perhaps they watch the spec commit history and nothing needs to > be done), but within a few months most users should have browsers that can > accept bitcoin as a web-app handleable protocol scheme. I suppose IE10 > users may be the laggards, but I guess we can live with that for now. >
This is great news for bitcon, and the IANA application will be improved if there is evidence of it being used
Quoted text (26 lines)
> > Ian pointed out some errors in the BIP21 spec. What's the process for > amending the BIP? Do we need to create a new one and mark the old one as > replaced, or can we just fix it in place given the relatively exotic nature > of most of the issues? Here's his feedback: > > > - BNF doesn't say what it's character set is (presumably it's Unicode) > > - "bitcoinparams" production doesn't define the separator, so in theory > the syntax is ...?label=foomessage=fooother=foo (rather than > ...?label=foo&message=foo etc) > > - the syntax allows ?amount=FOO&amount=1.1 as far as I can tell, since > "otherparam" matches any name followed by any value, including "amount" > followed by a bogus value. > > - "pchar" is referenced without definition. > > - the "simpler" syntax is just wrong (it would result in > bitcoin:address?amount=1?label=FOO rather > than bitcoin:address?amount=1&label=FOO) > > BTW the IETF URL specs are being obsoleted by http://url.spec.whatwg.org/, > at least for Web purposes. In that case matters. >
Not 100% sure how accurate this is, tho it may be the world view of some folks in WHATWG. WHATWG is not a major standards body tho. Work on improving the URL spec is always welcome, as it is the value proposition of the Web.
Quoted text (15 lines)
> > > > ------------------------------------------------------------------------------ > Try New Relic Now & We'll Send You this Cool Shirt > New Relic is the only SaaS-based application performance monitoring service > that delivers powerful full stack analytics. Optimize and monitor your > browser, app, & servers with just a few lines of code. Try New Relic > and get this awesome Nerd Life shirt! http://p.sf.net/sfu/newrelic_d2d_apr > _______________________________________________ > Bitcoin-development mailing list > Bitcoin-development@lists•sourceforge•net > https://lists.sourceforge.net/lists/listinfo/bitcoin-development > >
On Wed, Apr 24, 2013 at 7:51 AM, Gavin Andresen <gavinandresen@gmail•com> wrote:
Quoted text (6 lines)
>> Ian pointed out some errors in the BIP21 spec. What's the process for >> amending the BIP? Do we need to create a new one and mark the old one as >> replaced, or can we just fix it in place given the relatively exotic nature >> of most of the issues? > Those all sound like bugs in the BIP; I think they should just be fixed, I > don't think we need a new BIP.
Yup. Corrections are fine, esp ones which are not gratuitously incompatible.
Chrome has whitelisted bitcoin: URIs for web apps, and Firefox it turns out doesn't use whitelisting at all, so it already works there.
https://chromiumcodereview.appspot.com/14531004
I'm hoping this means web wallet developers won't be put off from supporting the payment protocol (that risk is the reason I started this work).
The next step is to file bugs against WebKit (for Safari/iOS/misc other platforms), and IE, though I don't know if Microsoft uses open bug trackers much.
On Wed, Apr 24, 2013 at 6:37 PM, Gregory Maxwell <gmaxwell@gmail•com> wrote:
Quoted text (14 lines)
> On Wed, Apr 24, 2013 at 7:51 AM, Gavin Andresen <gavinandresen@gmail•com> > wrote: > >> Ian pointed out some errors in the BIP21 spec. What's the process for > >> amending the BIP? Do we need to create a new one and mark the old one as > >> replaced, or can we just fix it in place given the relatively exotic > nature > >> of most of the issues? > > Those all sound like bugs in the BIP; I think they should just be fixed, > I > > don't think we need a new BIP. > > Yup. Corrections are fine, esp ones which are not gratuitously > incompatible. >