Re: Requesting comments on draft-cheney-safe-02.txt

[Rich Kulawiec <[e-mail]>]

On Fri, Jul 31, 2009 at 02:36:31AM +0400, Cheney, Edward A SSG RES USAR USARC wrote:
> The idea is that security vulnerabilities on the internet occur
> most significantly as a result of client-side scripting from documents
> transmitted across HTTP.

Even we grant for the purpose of argument that these are the "most
significant", and I see no evidence that they are, these are not
Internet security vulnerabilities.

These are (a) web browser and (b) operating system vulnerabilities,
and are quite readily mitigated by making sensible choices about both.
Further mitigation is possible by using in-band filtering/blocking
(such as HTTP proxies which filter or block traffic) or by using
browser extensions (e.g., NoScript).  These are much simpler and directed
solutions that are available immediately, without any need for protocol
engineering.

If, on the other hand, poor choices of web browser and/or operating system
(or mail client, for that matter) are made, then it really doesn't matter
whether traffic moves via HTTP or SMTP or anything else: those systems
WILL be compromised.

---Rsk