Re: Requesting comments on draft-cheney-safe-02.txt

[Hector Santos <[e-mail]>]

+1

Rich Kulawiec wrote:

> On Fri, Jul 31, 2009 at 02:36:31AM +0400, Cheney, Edward A SSG RES USAR USARC wrote:
>> The idea is that security vulnerabilities on the internet occur
>> most significantly as a result of client-side scripting from documents
>> transmitted across HTTP.
> 
> Even we grant for the purpose of argument that these are the "most
> significant", and I see no evidence that they are, these are not
> Internet security vulnerabilities.
> 
> These are (a) web browser and (b) operating system vulnerabilities,
> and are quite readily mitigated by making sensible choices about both.
> Further mitigation is possible by using in-band filtering/blocking
> (such as HTTP proxies which filter or block traffic) or by using
> browser extensions (e.g., NoScript).  These are much simpler and directed
> solutions that are available immediately, without any need for protocol
> engineering.
> 
> If, on the other hand, poor choices of web browser and/or operating system
> (or mail client, for that matter) are made, then it really doesn't matter
> whether traffic moves via HTTP or SMTP or anything else: those systems
> WILL be compromised.
> 
> ---Rsk
> 
> 
> 



-- 
Sincerely

Hector Santos
http://www.santronics.com