[standards-jig] defeating invisibility
Matthew A. Miller
linuxwolf at outer-planes.net
Wed Jan 21 15:09:05 UTC 2004
There is a difference between being simple and being dumb. To neglect
or ignore security concerns is being dumb, not simple.
Let's take the long view on this. There will be organizations that will
introduce new protocols to Jabber/XMPP, either through the JSF or
otherwise, and some of these new protocols will most likely introduce
new security concerns very similar (if not identical) to this one. To
require servers to handle these security concerns on behalf of clients
means that such a server would need to know of every potential security
concern, now and in the future. This is not realistic, especially for a
protocol interacts "entirely" on the edges.
I'm not saying server implementations SHOULD NOT do this, but I am
saying that clients SHOULD NOT rely on their servers to magically know
what's "safe" and what's not. To rely on one point to get it right is
not the way to go. Everyone needs to play, or it doesn't work out.
Bart van Bragt wrote:
> Matthew A. Miller wrote:
>> Sometimes a client needs to be attentive to its situation (-:
> Hmm, true..
> But what about 'simple client, complex server'?
> Ofcourse it's easier from a protocol point of view to solve all this
> in the client but IMO that undermines one of the most important
> principles on which Jabber/XMPP is built.
> Standards-JIG mailing list
> Standards-JIG at jabber.org
More information about the Standards