Re: [OAUTH-WG] Adam Roach's No Objection on draft-ietf-oauth-native-apps-11: (with COMMENT)

Alexey Melnikov <aamelnikov@fastmail.fm> Tue, 23 May 2017 10:09 UTC

Return-Path: <aamelnikov@fastmail.fm>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 84F89129451; Tue, 23 May 2017 03:09:21 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.719
X-Spam-Level:
X-Spam-Status: No, score=-2.719 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fastmail.fm header.b=aZw3Xkg4; dkim=pass (2048-bit key) header.d=messagingengine.com header.b=NAeXh1jm
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Um2hsNU_zxfC; Tue, 23 May 2017 03:09:19 -0700 (PDT)
Received: from out1-smtp.messagingengine.com (out1-smtp.messagingengine.com [66.111.4.25]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 733A812943E; Tue, 23 May 2017 03:09:19 -0700 (PDT)
Received: from compute7.internal (compute7.nyi.internal [10.202.2.47]) by mailout.nyi.internal (Postfix) with ESMTP id DCBC720911; Tue, 23 May 2017 06:09:18 -0400 (EDT)
Received: from web5 ([10.202.2.215]) by compute7.internal (MEProxy); Tue, 23 May 2017 06:09:18 -0400
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fastmail.fm; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to:x-me-sender :x-me-sender:x-sasl-enc; s=fm1; bh=jyfMyquvPU8o3dHgJKiT9Fo1r1Z2C EbseCGnk69Nthc=; b=aZw3Xkg4JO5oHw78z2fLMkeq47XKCg1u+P2WSv6BYNjqk EUdLmnebBGFfPw6wqFHxXW1ramd1cuYKaBpMx6FgQMj7rLMM/jYDhG8hpupFhlGq UDhGL0+QPCElJwAecjYqjkxpv/lzJXp+G4lwaGule2RRjRq/BTP/FJ6fGYcnkKH4 DXqUVEtqJuLk85OYCFeYm9tllltijchPs//14TeDGp8h+9xwuJLoaZH4Qn4JbzIp ZEYIfH/gHV6u2uCpnvgifkG2GHW+wpO4feEe96i/mP8IwEo32QUs+e6VJhJy1M/w IKVDFZx6Ur/B9mRgTCJQhiVzITluhaggn7hpqsXaA==
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:content-transfer-encoding:content-type :date:from:in-reply-to:message-id:mime-version:references :subject:to:x-me-sender:x-me-sender:x-sasl-enc; s=fm1; bh=jyfMyq uvPU8o3dHgJKiT9Fo1r1Z2CEbseCGnk69Nthc=; b=NAeXh1jmvvGpGV6JKtDLaX Ic+Om4/aXYhIWj/70uzkmwjXUpON22OvsjQeb8PQINBSkMk2rhpPdFDSkMEXMlVU H6mdfxKByfYnTWvBrhMfHorftfwW3nWIvbm9JTv6jvdQegkrlA5dvIyagJbPopBD rQjVzNfUevpaqXMxNOSdCTFgKyIRVgvuq+tzHndtlcDRB9gpt3SPjsFTlLddgfny qokHN6nrzJ2uFOLrK0lFoOI/f3arWOfPIg6fO9bkrKKmd3wq95vZX1D5Kq9hfUAO jIyyceWcp+h9Gf8G0GxK/XtX2FPAcwyQHxiqEgmwulXZNDg9i0Z4dTAVxI4SoCaw ==
X-ME-Sender: <xms:TgokWYqbHNRnaqN2ZSPWK0SBqPeUuGeGvWYz0IGf_7DyDq22GAq8PA>
Received: by mailuser.nyi.internal (Postfix, from userid 99) id B98A69E23B; Tue, 23 May 2017 06:09:18 -0400 (EDT)
Message-Id: <1495534158.1405045.985657536.26AE401D@webmail.messagingengine.com>
From: Alexey Melnikov <aamelnikov@fastmail.fm>
To: William Denniss <wdenniss@google.com>
Cc: Adam Roach <adam@nostrum.com>, draft-ietf-oauth-native-apps@ietf.org, Hannes Tschofenig <Hannes.Tschofenig@gmx.net>, oauth@ietf.org, The IESG <iesg@ietf.org>, oauth-chairs@ietf.org
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Type: multipart/alternative; boundary="_----------=_149553415814050450"
X-Mailer: MessagingEngine.com Webmail Interface - ajax-a5162694
References: <149548482877.9096.13896958451655712801.idtracker@ietfa.amsl.com> <CAAP42hAcc5qGCxMC-Qj=G5BKQ9kRv9N6_pdtjH8mxUCcFCD_8g@mail.gmail.com> <1D2FDD6E-3DA0-4E7C-BBF3-1A6146F7889B@fastmail.fm>
Date: Tue, 23 May 2017 11:09:18 +0100
In-Reply-To: <1D2FDD6E-3DA0-4E7C-BBF3-1A6146F7889B@fastmail.fm>
Archived-At: <https://mailarchive.ietf.org/arch/msg/oauth/QpE9pTNXw6eVIMwlhTWFGd1PLmo>
Subject: Re: [OAUTH-WG] Adam Roach's No Objection on draft-ietf-oauth-native-apps-11: (with COMMENT)
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/oauth/>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 23 May 2017 10:09:21 -0000

On Tue, May 23, 2017, at 10:24 AM, Alexey Melnikov wrote:
> Hi William,
> 
> On 22 May 2017, at 23:14, William Denniss <wdenniss@google.com> wrote:>>> Section 8.1 makes the statement that "Loopback IP based redirect
>>> URIs may>>>  be susceptible to interception by other apps listening on the same>>>  loopback interface." That's not how TCP listener sockets work:
>>>  for any>>>  given IP address, they guarantee single-process access to a port
>>>  at any>>>  one time. (Exceptions would include processes with root access,
>>>  but an>>>  attacking process with that level of access is going to be
>>>  impossible to>>>  defend against). While mostly harmless, the statement appears to be
>>>  false>>>  on its face, and should be removed or clarified.
>>> 
>> 
>> Will be removed in the next update. Thank you.
> 
> Actually, I disagree with Adam on this, because what he says is OS
> specific. So I think the text is valuable and should stay.> 
In particular, I think SO_REUSEADDR socket option is widely implemented,
both on Windows and Linux.