Re: IQ Handling vulnerabilities
Thijs Alkemade <[email protected]>
| Newsgroups | gmane.ietf.xmpp |
|---|---|
| Message-ID | <[email protected]> |
On 9 feb. 2014, at 23:04, Kevin Smith <[email protected]> wrote: > On Sun, Feb 9, 2014 at 7:30 PM, Dave Cridland <[email protected]> wrote: >> I'd hope Kev's example is way off, though - I suspect that servers ignore >> the XEP-0199 reply stanza and just look for activity on the socket. > > I would hope so, too - but given some of the things we've seen on the > client side in the last couple of weeks, I don't think it's > unreasonable to suspect there might be servers with as severe > problems. Whether we can find the vulnerabilities or not, though, > doesn't reduce the need to document the issues, I think. > > /K I’ve submitted an I-D about this issue here, to help discussion at IETF 89: http://datatracker.ietf.org/doc/draft-alkemade-xmpp-iq-validation/ Regards, Thijs _______________________________________________ xmpp mailing list [email protected] https://www.ietf.org/mailman/listinfo/xmpp
signature.asc
(application/pgp-signature, 841 B)
-----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iQIcBAEBAgAGBQJS+MIrAAoJELRGwhIrI4PElKwP/1GeUVgS8ISsJ5FVW+UeyIpk a6oFuGE4ThmjQVU0jA1WPkj02hGHCO/sxJEd9Rw/9CwUYjfVLnCKvEtMPs8Pjnv7 QpoUwWNwQ5r4RSlsI5GaRsWGhYdrfDYr5x270XYYAAthcgrGKEgJS9WlMLSF45yu 1MWGCkji2fwh2eERBG8An8qReJ41G0AEn4aOOqQN95jCM/U9D+P31IEckGCfu7og PYj9eBizSgHA6Aunznm0HNogLnDNCC9dN8SVxvB4/bHDR4Df9khfpO/ws7ik3iUu JKsucJmrFH8shN6chegw2O7FRXEn51WhahmAWFlQ7oPewgVYDwGvduIUFWTE7/gw PEe7/s2+GUuN/QzW8c0GuMr8fO6cXTmwyAq7T2fsCm9NQHXVPCHLQJRua024c1O9 xYK+hlLXtZzjCDXYvQpgudB1Txzdff2ungbNAwlSi5GhJ9mffk0eFlaH9W+X/qkA RmWtpqhSOIUteEg6OtIVLpEbDFk7/KoZBtSbXihgp8D3Cfuv76lZt/8ivOK7hATD oSFM5ofFlN7dx2nC7Gt9IoJnJiU8tq111rXAU/ysUdIyPkEdSfxGh86R0Sw2KgYY FSPrS0uD7gh6uhwwGPZunkFE1WZbdx1ANAaa65nCB2a3VkEi0yFa2ZUozX6Hu1CI Djc8rN/AjbIBXY5d5ng6 =R5Lr -----END PGP SIGNATURE-----