Subject: [domainrep] Drafts updated

From: "Murray S. Kucherawy" <[email-masked]>
Date: Tue, 13 Nov 2012 18:13:27 -0800

I gave it some thought and I think security considerations for REPUTE can
be grouped under two headings:

1) Those that are attacks on the building blocks we're using (HTTP, URI
syntax, MIME, etc.);

2) Those that are attacks on either reputation consumers or reputation
service providers.

For (1), these issues are all well-documented in the RFCs that define those
building blocks.  For (2), we have a new document under development that is
a collection of all of that material.

Accordingly, I've made the various Security Considerations documents point
to those places, rather than copying text from various places into the
individual documents which runs the risk of sending divergent messages to
readers.

Is this acceptable?

-MSK

---

From: "Hollenbeck, Scott" <[email-masked]>
Date: Wed, 14 Nov 2012 11:59:45 +0000

Yes, I like the approach. I plan on doing the same basic thing in the WEIRDS documents that have the same dependencies.

Scott

From: [email-masked] [mailto:[email-masked]] On Behalf Of Murray S. Kucherawy
Sent: Tuesday, November 13, 2012 9:13 PM
To: [email-masked]
Subject: [domainrep] Drafts updated

I gave it some thought and I think security considerations for REPUTE can be grouped under two headings:

1) Those that are attacks on the building blocks we're using (HTTP, URI syntax, MIME, etc.);

2) Those that are attacks on either reputation consumers or reputation service providers.

For (1), these issues are all well-documented in the RFCs that define those building blocks.  For (2), we have a new document under development that is a collection of all of that material.

Accordingly, I've made the various Security Considerations documents point to those places, rather than copying text from various places into the individual documents which runs the risk of sending divergent messages to readers.

Is this acceptable?

-MSK

---

From: Dave Crocker <[email-masked]>
Date: Wed, 14 Nov 2012 06:17:50 -0800

On 11/14/2012 3:59 AM, Hollenbeck, Scott wrote:
> Yes, I like the approach. I plan on doing the same basic thing in the
> WEIRDS documents that have the same dependencies.
>
> Scott
>
> *From:[email-masked] [mailto:[email-masked]]
...
> can be grouped under two headings:

Yeah.

We ran into this distinction for DKIM.  I assume it is generic to /any/ 
security mechanism spec.  And yes, the threats should be segmented 
according to these two broad categories.

d/.

-- 
  Dave Crocker
  bbiw.net