Re: Requesting comments on draft-cheney-safe-02.txt

[John C Klensin <[e-mail]>]

--On Friday, August 07, 2009 06:01 -0400 Rich Kulawiec
<[e-mail]> wrote:

> 
> On Fri, Jul 31, 2009 at 02:36:31AM +0400, Cheney, Edward A SSG
> RES USAR USARC wrote:
>> The idea is that security vulnerabilities on the internet
>> occur most significantly as a result of client-side scripting
>> from documents transmitted across HTTP.
> 
> Even we grant for the purpose of argument that these are the
> "most significant", and I see no evidence that they are, these
> are not Internet security vulnerabilities.
> 
> These are (a) web browser and (b) operating system
> vulnerabilities, and are quite readily mitigated by making
> sensible choices about both. Further mitigation is possible by
> using in-band filtering/blocking (such as HTTP proxies which
> filter or block traffic) or by using browser extensions (e.g.,
> NoScript).  These are much simpler and directed solutions that
> are available immediately, without any need for protocol
> engineering.
> 
> If, on the other hand, poor choices of web browser and/or
> operating system (or mail client, for that matter) are made,
> then it really doesn't matter whether traffic moves via HTTP
> or SMTP or anything else: those systems WILL be compromised.
>...
 
Reinforcing this point, I note that there are several MUAs that
interpret HTML in a very limited environment, preventing
execution of scripts, web bugs, etc., rather than
indiscriminately invoking full browsers each time an HTML
message comes in.  And, as Rich points out, those precautions do
not require protocol engineering, much less convincing those who
develop and send messages to adopt different tools and
procedures.

   john