Subject: RE: [Simple] Filtering: possible security issue?

From: <[email-masked]>
Date: Fri, 10 Mar 2006 09:09:54 +0100

I think, if this is the interpretation, the text needs to be rewrited
more clearly since it could originate misunderstanding.

BR,

Michal Burda

> -----Original Message-----
> From: Hisham Khartabil [mailto:[email-masked]]
> Sent: Wednesday, March 08, 2006 2:55 PM
> To: Burda Michal
> Cc: [email-masked]
> Subject: Re: [Simple] Filtering: possible security issue?
> 
> Ignoring the filter in this sense does not mean not applying it. it
> means that you replace the information that the filter is asking for
in
> a <what> element with bogus information. For <trigger> elements, this
> doesnt apply i dont think.
> 
> Hisham
> 
> On Mar 8, 2006, at 2:29 PM, <[email-masked]> wrote:
> 
> > Hi,
> >
> > draft-ietf-simple-event-filter-funct-05.txt says: "If polite
blocking
> > is
> > used by the notifier, the notifier may choose to ignore the filter,
by
> > choosing to deliver notifications containing bogus information in
the
> > unauthorised elements or attributes."
> >
> > I think it can result in a security leak since the subscriber could
> > create such filter, that if ignored, gives the subscriber
information
> > that he/she is polite blocked...
> >
> > Could anyone please post any suggestions/comments?
> >
> >
> > Best regards,
> >
> >
> > Michal Burda
> >
> >
> > _______________________________________________
> > Simple mailing list
> > [email-masked]
> > https://www1.ietf.org/mailman/listinfo/simple
> >

_______________________________________________
Simple mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/simple