Re: [clue] Kathleen Moriarty's Discuss on draft-ietf-clue-data-model-schema-14: (with DISCUSS)

[Simon Pietro Romano <[e-mail]>]

Perfect. Version -16 of the draft will embed the mentioned paragraph.

Thanx,

Simon & Roberta

> On 03/giu/2016, at 14:41, [e-mail] wrote:
> 
> 
> 
> Sent from my iPhone
> 
>> On Jun 3, 2016, at 7:02 AM, Simon Pietro Romano <[e-mail]> wrote:
>> 
>> Hello Kathleen,
>> 
>> as far as point 2 below is concerned:
>> 
>>>>> 2. Schema drafts tend to cover the need for well-formed schemas as part
>>>>> of the security considerations.  Can you add something in about that (not
>>>>> much is required, but it's good for implementers to know this is
>>>>> important)?  You can see two recent examples for guidance:
>>>>> YANG - https://datatracker.ietf.org/doc/draft-ietf-netmod-rfc6020bis/
>>>>> IODEF - https://datatracker.ietf.org/doc/draft-ietf-mile-rfc5070-bis/
>> 
>> …are you sure this is really needed? This seems definitely pleonastic to me. This said, if you think we’d better explicitly mention such a point, would you be ok with the following text
>> (entirely borrowed from the YANG RFC)?
>> 
>> "XML parsers need to be robust with respect to malformed documents. Reading malformed documents from unknown or untrusted sources could result in an attacker gaining 
>> privileges of the user running the XML parser. In an extreme situation, the entire machine could be compromised.”
> 
> Yes, this would be very good.  I liked the text in that document, hence the reference.
> 
> Thanks,
> Kathleen 
> 
>> 
>> Thanks,
>> 
>> Simon
>> 
>> 
>> 
>> 
>> 
>>                                               _\\|//_
>>                                                ( O-O )
>>  ~~~~~~~~~~~~~~~~~~~~~~o00~~(_)~~00o~~~~~~~~~~~~~~~~~~~~~~~~
>>                                   Simon Pietro Romano
>>                             Universita' di Napoli Federico II
>>                            Computer Engineering Department 
>>                Phone: [phone] -- Fax: [phone]
>>                                          e-mail: [e-mail]
>> 
>>           <<Molti mi dicono che lo scoraggiamento è l'alibi degli 
>>           idioti. Ci rifletto un istante; e mi scoraggio>>. Magritte.
>>                                               oooO
>> ~~~~~~~~~~~~~~~~~~~~~~~(   )~~~ Oooo~~~~~~~~~~~~~~~~~~~~~~~~~
>>                                    \ (            (   )
>>                                             \_)          ) /
>>                                                                      (_/
>> 
>> 
>> 
>> 
>> 
>> 
> 

                     					       _\\|//_
                           				      ( O-O )
   ~~~~~~~~~~~~~~~~~~~~~~o00~~(_)~~00o~~~~~~~~~~~~~~~~~~~~~~~~
                    				Simon Pietro Romano
             				 Universita' di Napoli Federico II
                		     Computer Engineering Department 
	             Phone: [phone] -- Fax: [phone]
                                           e-mail: [e-mail]

		    <<Molti mi dicono che lo scoraggiamento è l'alibi degli 
		    idioti. Ci rifletto un istante; e mi scoraggio>>. Magritte.
               			                     oooO
  ~~~~~~~~~~~~~~~~~~~~~~~(   )~~~ Oooo~~~~~~~~~~~~~~~~~~~~~~~~~
					                 \ (            (   )
			                                  \_)          ) /
                                                                       (_/