[media-types] [IANA #1443809] application/vnd.vnd.zo ho-document.writer registration request

Hi Darrel,

You can disregard this approval request. As the requester has now accepted the text you proposed, the only remaining issue for this request and application/vnd.zoho.spreadsheetml.sheet is the extra "vnd.," which we'll fix. We understand these to be ready for registration. 

thanks,
Amanda

On Sun Mar 22 01:27:23 2026, david.dong wrote:
> Hi Darrel (filling in for Amanda),
> 
> The requester has accepted the replacement text suggested.
> 
> Can the vnd.vnd.zoho-document.writer and vnd.zoho.spreadsheetml.sheet
> registration requests now be approved, with this change?
> 
> Thank you.
> 
> Best regards,
> 
> David Dong
> IANA Services Sr. Specialist
> 
> On Sun Mar 15 03:39:51 2026, [email protected] wrote:
> > Hi Amanda,
> >
> > Sorry for the slow response on these.
> >
> > The clarification from Zoho is helpful - the intent is clear, but I
> > don't think appending it to the existing text is the right approach.
> > The problem is the original paragraph itself:
> >
> > > "Recipients need to understand that they are at the 'mercy' of the
> > > sender, when receiving this type of data, since data will be
> > > executed
> > > on their system, and the security of their machines can be
> > > violated."
> >
> > This reads as a warning against ever accepting content of this type.
> > For comparison, the application/vnd.openxmlformats-
> > officedocument.wordprocessingml.document registration, which faces
> > essentially the same risks, handles it like this:
> >
> > > "An OOXML document of this subtype may contain executable contents
> > > other than macros or Active-X controls... However, such executable
> > > contents are beyond [the spec]. Such executable contents are not
> > > invoked by MS Office and similar office suites."
> >
> > I'd suggest Zoho replace the alarming paragraph with something along
> > the lines of:
> >
> > > "A document of this subtype may contain executable content, since
> > > the
> > > underlying ZIP container allows such content. However, such
> > > executable content is not invoked by [Zoho Writer / Zoho Sheet]."
> >
> > This is factually equivalent to what Zoho clarified, but I think more
> > appropriate for a registration template. The same change should apply
> > to both registrations.
> >
> > Darrel
> > ________________________________
> > From: Amanda Baber via RT <[email protected]>
> > Sent: Wednesday, March 11, 2026 4:49 PM
> > Cc: [email protected] <[email protected]>; Darrel Miller
> > <[email protected]>
> > Subject: [IANA #1443809] application/vnd.vnd.zoho-document.writer
> > registration request
> >
> > Hi Darrel,
> >
> > Resending this response from February 25th. #1 of 2.
> >
> > thanks,
> > Amanda
> >
> > On Wed Feb 25 01:43:24 2026, amanda.baber wrote:
> > > Hi Darrel,
> > >
> > > Response from the requester:
> > >
> > > ===
> > >
> > > It is similar to the risks a docx file received from a sender. The
> > > docx file can contain
> > > any malware, but it will not be executed by the MS Word program.
> > >
> > > Similarly, the doc file received from a sender can contain any
> > > malware, but it will
> > > not be executed by the Zoho Writer program.
> > >
> > > Please get back to us for any clarifications in this regard.
> > >
> > > ===
> > >
> > > Does that work? Should those first two paragraphs be added to the
> > > security considerations, if they confirm that this is their
> > > intention?
> > >
> > > We'll remove the extra "vnd."
> > >
> > > thanks,
> > > Amanda
> > >
> > > On Sat Feb 21 19:13:16 2026, [email protected] wrote:
> > > > The name of this subtype is not valid due to the duplicate
> > > > "vnd.".
> > > > It
> > > > should be vnd.zoho-document.writer.
> > > >
> > > >
> > > > *
> > > > Recipients need to understand that they are at the
> > > > > "mercy" of the sender, when receiving this type of data, since
> > > > > data
> > > > > will be executed on their system, and the security of their
> > > > > machines
> > > > > can be violated.
> > > >
> > > >
> > > > This comment is concerning. It would be good to get more clarity
> > > > as
> > > > to
> > > > what the risks are here.  This statement is sufficiently alarmist
> > > > that
> > > > nobody should be accepting data with this media type.
> > > >
> > > > Darrel
> > > > ________________________________
> > > > From: Amanda Baber via RT <[email protected]>
> > > > Sent: Wednesday, February 18, 2026 2:40 PM
> > > > Cc: [email protected] <[email protected]>; Darrel Miller
> > > > <[email protected]>
> > > > Subject: [IANA #1443809] application/vnd.vnd.zoho-document.writer
> > > > registration request
> > > >
> > > > Hi Darrel,
> > > >
> > > > Sending a reminder for this request from February 11th.
> > > >
> > > > thanks,
> > > > Amanda
> > > >
> > > > On Wed Feb 11 19:02:45 2026, amanda.baber wrote:
> > > > > Hi Darrel,
> > > > >
> > > > > Would you be able to review this new request for us by February
> > > > > 25th?
> > > > >
> > > > > You approved a Zoho media type last month, but wrote, "While
> > > > > RFC
> > > > > 6838
> > > > > Section 4.4 (https://www.rfc
> > > > > editor.org/rfc/rfc6838.html#section-
> > > > > 4.4)
> > > > > does not require public specifications for vendor tree
> > > > > registrations,
> > > > > I recommend that Zoho consider publishing at least a basic
> > > > > format
> > > > > specification for this media type given its intended COMMON
> > > > > usage.
> > > > > Public documentation would improve interoperability and
> > > > > transparency
> > > > > for recipients of .zshow files." That advice was passed on.
> > > > >
> > > > > thanks,
> > > > > Amanda
> > > > >
> > > > > =====
> > > > >
> > > > > Name: Manivannan Subburaj
> > > > >
> > > > > Email: [email protected]
> > > > >
> > > > > Media type name: application
> > > > >
> > > > > Media subtype name: vnd.vnd.zoho-document.writer
> > > > >
> > > > > Required parameters: N/A
> > > > >
> > > > > Optional parameters: N/A
> > > > >
> > > > > Encoding considerations: binary
> > > > >
> > > > > This media type may require encoding on transports not capable
> > > > > of
> > > > > handling binary.
> > > > >
> > > > > Security considerations: It is a ZIP package containing json
> > > > > files,
> > > > > image files.
> > > > >
> > > > > An zdoc document of this sub-type may contain executable
> > > > > content;
> > > > > such
> > > > > executable contents are not invoked by Zoho Writer.
> > > > >
> > > > > An zdoc document of this sub-type may contain personal
> > > > > information,
> > > > > but cannot be encrypted. It may include hyper-links to other
> > > > > objects.
> > > > > Implementors should pay special attention to security of
> > > > > resolving
> > > > > such external references.
> > > > >
> > > > > There are no mechanisms in zdoc document to verify the
> > > > > integrity
> > > > > of
> > > > > documents (e.g. digital signatures). Users have to rely on
> > > > > external
> > > > > applications, should such integrity verification be required.
> > > > >
> > > > > As with most application types this data is intended for
> > > > > interpretation by a program that understands the data on the
> > > > > recipient's system. Recipients need to understand that they are
> > > > > at
> > > > > the
> > > > > "mercy" of the sender, when receiving this type of data, since
> > > > > data
> > > > > will be executed on their system, and the security of their
> > > > > machines
> > > > > can be violated.
> > > > >
> > > > > Interoperability considerations: None
> > > > >
> > > > > Published specification: None
> > > > >
> > > > > Applications which use this media: Zoho Writer
> > > > >
> > > > > Fragment identifier considerations: None
> > > > >
> > > > > Restrictions on usage: None
> > > > >
> > > > > Provisional registration? (standards tree only): No
> > > > >
> > > > > Additional information:
> > > > >
> > > > > 1. Deprecated alias names for this type: None
> > > > > 2. Magic number(s): 50 4b 03 04 as in ZIP
> > > > > 3. File extension(s): zdoc
> > > > > 4. Macintosh file type code: No specified Macintosh file type
> > > > > code(s)
> > > > > for Zoho Writer.
> > > > > 5. Object Identifiers: None
> > > > >
> > > > > General Comments:
> > > > >
> > > > > Person to contact for further information:
> > > > >
> > > > > 1. Name: Ganeshprabhu Rajendran
> > > > > 2. Email: [email protected]
> > > > >
> > > > > Intended usage: COMMON
> > > > >
> > > > > Author/Change controller: [email protected]

_______________________________________________
media-types mailing list -- [email protected]
To unsubscribe send an email to [email protected]