Re: [Model-t] w3c also thinking about threat models

On Mon, Sep 23, 2019, 11:07 AM Joel M. Halpern <jmh@joelhalpern.com> wrote:

> It seems pretty clear to me that if we take the view that everything is
> in scope, we will not produce any useful improvements in our current
> security considerations in any reasonably measurable time.
>
> It seems to follow that if we want useful results, we had best find
> somewhere to draw a line and agree that we will deal with some
> well-defined scope.
>
> Of course, if all people want is a place to complain about the
> interaction of architecture, protocol, implementation, and underlying
> hardware flaws, I guess we can just complain forever.
>

Amen! But I think we can look at actual gaps in the network security model
vs the host security model vs what programmers and users expect etc. XSS
can be seen as a consequence of lacking quotation mechanisms in server
interpolated strings.

We also shouldn't privilege one use case over others.

> Yours,
> Joel
>
> On 9/23/2019 1:45 PM, Christian Huitema wrote:
> >
> >
> >> On Sep 23, 2019, at 5:32 AM, Stephen Farrell <stephen.farrell@cs.tcd.ie>
> wrote:
> >>
> >> Bret,
> >>
> >>> On 23/09/2019 15:41, Bret Jordan wrote:
> >>>
> >>> Given how nearly all attacks, campaigns, malware, and intrusion sets
> >>> use the web or software connecting to the web
> >>
> >> Malware (ab)using the web doesn't imply anything about
> >> what might be right or wrong with the current web security
> >> model though. Same as malware doing that doesn't imply
> >> anything about the security model for IP, which is also
> >> in use in almost all such cases.
> >
> > Au contraire!
> >
> > The past decades should have taught us that bug happens and are
> exploited. That's very relevant for the Internet threat model. If a server
> is exploited, will clients and further servers fall off like dominoes? What
> kind of defense in depth have we built in the architecture? How do we
> isolate nodes when they are faulty? What remediation strategies do we have
> available ?
> >
> > You can apply this analysis to multiple subsystems. For example, if a
> name server is compromised, can the attackers gain access to the domains
> that it serves? Can they obtain certificates?
> >
> > -- Christian Huitema
> >
>
> --
> Model-t mailing list
> Model-t@iab.org
> https://www.iab.org/mailman/listinfo/model-t
>