[standards-jig] Security problems with JEP-115

Jacek Konieczny jajcus at bnet.pl
Thu Sep 18 15:51:30 UTC 2003


On Thu, Sep 18, 2003 at 08:43:19AM -0600, Matthew A. Miller wrote:
> First, I would like you to *fully* explain how this allows one client 
> (client-A) to disable features of another client (client-B) (and not 
> simply allow client-B to "mask" capabilities to, or work differently 
> with, client-A).

Such "masking" is bad enough. Imagine that the client B is configured to
use encryption with any other client that supports it. When this
capability is masked client-B would send unencrypted messages.

> Second, this JEP does provide a bitmask (of sorts), via the "ext" 
> attribute.  The JEP also outlines a number of rules on how it's applied 
> and used. Again, if this isn't adequate, detailed insight is greatly 
> appreciated.

The problem is that meaning of bundle names is not defined and probably
not trusted source has to be asked for the meaning.

> As was previously stated, if you provide a another solution, we'll 
> consider it; if you provide a better solution, we'll use it!  

See the other post for my MD5-based improvement proposition.

> But in this case, the call of "do nothing" just isn't enough.

We have many JEPs which were proofed bad at some moment. IMHO it is
better to show that some way looks wrong at its begining.

Greets,
        Jacek



More information about the Standards mailing list