Feedback request on "printer-icons" and "printer-more-info-manufacturer" in PWG IPP-Infra

Hi,

We are investigating how we should support the bucket of IPP attributes that contain URI values pointing to printer resources, such as

  *   printer-more-info-manufacturer
  *   printer-icons
  *   Printer-icc-profiles -> profile-url
  *   etc.

For this bucket of attributes, under the current IPP-Infra<https://ftp.pwg.org/pub/pwg/candidates/cs-ippinfra10-20150619-5100.18.pdf> section 4.2.6 "Printer ICC Profiles, Icons, and Other URIs",
[cid:67cae771-944e-4ef7-82f7-bfca8e6c90de]

In our case, it would be in the following IPP-Infra model:
[cid:7b41cb68-fec1-471d-80e9-52b65def42a9]
The current IPP-Infra spec implies that both the physical printer ("Proxy") and the cloud service ("Infrastructure Printer") both return values for these IPP attributes that are "Public Internet Accessible".  The spec defines "Public Internet Accessible" as "can be accessed via the public Internet without additional credentials or authentication".

We have some security / privacy concerns regarding the cloud service ("Infrastructure Printer") providing URI value(s) that are open to the world without needing any credentials. For the physical printer ("Proxy"), at least the IPP-Infra spec offers an alternative where it can upload the resource files to the cloud service ("Infrastructure Printer").

For example, we would not want an in-development printer which sent this info to the cloud service to have their printer icon and details to be exposed to the Internet.

We feel that it should at least be an option for the cloud service ("Infrastructure Printer") to lock down access to the resource behind some credentials.
Appreciate any insight you have to mitigate concerns.

Regards,
Jimmy

_______________________________________________
ipp mailing list
[email protected]
https://www.pwg.org/mailman/listinfo/ipp