Subject: Security considerations

From: Doug Royer <[email-masked]>
Date: Mon, 18 Aug 2003 13:20:15 -0600

The CAP security considerations sections is going to need to be
expanded prior to being published as an RFC.

So I propose the following new topics:

(1) Risks of allowing anonymous UPNs to deposit REQUEST
     and REFRESH objects. (calendar spam and D.O.S.)

(2) Suggest that CS implementations automatically create
     VCARs that allow CAP ATTENDEEs in booked objects to
     deposit REFRESH and REPLY objects for those UIDs
     if they otherwise do not have access.

     And they may consider also allowing COUNTER objects
     for those ATTENDEEs.

(3) Suggest that when an object is booked the CS reply
     with warning messages to the CUA for ATTENDEEs that have
     CAP urls that do not have local UPNs as those ATTENDEES may
     be unable to REPLY or REFRESH.

     Some CSs may wish this to be an error.

Others? Suggestions welcome...

-- 

  Doug Royer                     |   http://INET-Consulting.com
  -------------------------------|-----------------------------
  [email-masked]                 | Office: (208)612-INET
  http://Royer.com/People/Doug   |    Fax: (866)594-8574
                                 |   Cell: (208)520-4044

                 We Do Standards - You Need Standards