Subject: RE: [NSIS] Security Threats for NSIS : Relevant Communications Mo dels

From: "Hancock, Robert" <[email-masked]>
Date: Thu, 15 Apr 2004 16:47:59 +0100

[snip]

> i think we should do the following: 
>  - we should polish the individual threats (see other mails)
yes

>  - we should not include security requirements
ok

>  - we should not include solutions aspects
i think references to solutions could be useful (because they often
clarify the threats), provided this is clearly the reason for 
referring to them

>  - we should clearly point the main intention of the document and that
> additional information is found in the related documents
this is the absolutely crucial aspect. i agree with what you
propose ("the threats document address the nsis protocol suite...")
but I guess we need a commitment from "The Management" that they think
so too.

>  - we should do something with section 2 (i hope to receive 
> some comments)
provided the above aspects are made clear in it, probably not much
different needs to be done. (It would be nice to have at least some
definition of the word "trust", even if it was "'trust' is used 
informally with its normal English meaning".)

r.

> 
> ciao
> hannes
> 
> _______________________________________________
> nsis mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/nsis
> 

_______________________________________________
nsis mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nsis