Re: IQ Handling vulnerabilities

On Sun, Feb 9, 2014 at 7:30 PM, Dave Cridland <[email protected]> wrote:
> I'd hope Kev's example is way off, though - I suspect that servers ignore
> the XEP-0199 reply stanza and just look for activity on the socket.

I would hope so, too - but given some of the things we've seen on the
client side in the last couple of weeks, I don't think it's
unreasonable to suspect there might be servers with as severe
problems. Whether we can find the vulnerabilities or not, though,
doesn't reduce the need to document the issues, I think.

/K