Re: IQ Handling vulnerabilities
Peter Saint-Andre <[email protected]>
| Newsgroups | gmane.ietf.xmpp |
|---|---|
| Message-ID | <[email protected]> |
On 2/10/14, 5:12 AM, Thijs Alkemade wrote: > > On 9 feb. 2014, at 23:04, Kevin Smith <[email protected]> wrote: > >> On Sun, Feb 9, 2014 at 7:30 PM, Dave Cridland <[email protected]> wrote: >>> I'd hope Kev's example is way off, though - I suspect that servers ignore >>> the XEP-0199 reply stanza and just look for activity on the socket. >> >> I would hope so, too - but given some of the things we've seen on the >> client side in the last couple of weeks, I don't think it's >> unreasonable to suspect there might be servers with as severe >> problems. Whether we can find the vulnerabilities or not, though, >> doesn't reduce the need to document the issues, I think. >> >> /K > > I’ve submitted an I-D about this issue here, to help discussion at IETF 89: > > http://datatracker.ietf.org/doc/draft-alkemade-xmpp-iq-validation/ Hi Thijs, The document looks good to me. I'll review it in more detail after I submit the ~10 I-Ds I need to update this week. :-) Peter -- Peter Saint-Andre https://stpeter.im/