Message-Id: <1495534158.1405045.985657536.26AE401D@webmail.messagingengine.com>
From: Alexey Melnikov <aamelnikov@fastmail.fm>
To: William Denniss <wdenniss@google.com>
Cc: Adam Roach <adam@nostrum.com>, draft-ietf-oauth-native-apps@ietf.org,
 Hannes Tschofenig <Hannes.Tschofenig@gmx.net>, oauth@ietf.org,
 The IESG <iesg@ietf.org>, oauth-chairs@ietf.org
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Type: multipart/alternative; boundary="_----------=_149553415814050450"
References: <149548482877.9096.13896958451655712801.idtracker@ietfa.amsl.com>
 <CAAP42hAcc5qGCxMC-Qj=G5BKQ9kRv9N6_pdtjH8mxUCcFCD_8g@mail.gmail.com>
 <1D2FDD6E-3DA0-4E7C-BBF3-1A6146F7889B@fastmail.fm>
Date: Tue, 23 May 2017 11:09:18 +0100
In-Reply-To: <1D2FDD6E-3DA0-4E7C-BBF3-1A6146F7889B@fastmail.fm>
Archived-At: <https://mailarchive.ietf.org/arch/msg/oauth/QpE9pTNXw6eVIMwlhTWFGd1PLmo>
Subject: Re: [OAUTH-WG] Adam Roach's No Objection on
 draft-ietf-oauth-native-apps-11: (with COMMENT)
Precedence: list

This is a multi-part message in MIME format.

--_----------=_149553415814050450
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset="utf-8"

On Tue, May 23, 2017, at 10:24 AM, Alexey Melnikov wrote:
> Hi William,
> 
> On 22 May 2017, at 23:14, William Denniss <wdenniss@google.com> wrote:>>> Section 8.1 makes the statement that "Loopback IP based redirect
>>> URIs may>>>  be susceptible to interception by other apps listening on the same>>>  loopback interface." That's not how TCP listener sockets work:
>>>  for any>>>  given IP address, they guarantee single-process access to a port
>>>  at any>>>  one time. (Exceptions would include processes with root access,
>>>  but an>>>  attacking process with that level of access is going to be
>>>  impossible to>>>  defend against). While mostly harmless, the statement appears to be
>>>  false>>>  on its face, and should be removed or clarified.
>>> 
>> 
>> Will be removed in the next update. Thank you.
> 
> Actually, I disagree with Adam on this, because what he says is OS
> specific. So I think the text is valuable and should stay.> 
In particular, I think SO_REUSEADDR socket option is widely implemented,
both on Windows and Linux.

--_----------=_149553415814050450
Content-Transfer-Encoding: 7bit
Content-Type: text/html; charset="utf-8"

<!DOCTYPE html>
<html>
<head>
<title></title>
</head>
<body><div>On Tue, May 23, 2017, at 10:24 AM, Alexey Melnikov wrote:<br></div>
<blockquote type="cite"><div>Hi William,<br></div>
<div><div><br></div>
<div>On 22 May 2017, at 23:14, William Denniss &lt;<a href="mailto:wdenniss@google.com">wdenniss@google.com</a>&gt; wrote:<br></div>
</div>
<blockquote type="cite"><blockquote defang_data-gmailquote="yes" style="margin-top:0px;margin-right:0px;margin-bottom:0px;margin-left:0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204, 204, 204);padding-left:1ex;"><div>Section 8.1 makes the statement that "Loopback IP based redirect URIs may<br></div>
<div> be susceptible to interception by other apps listening on the same<br></div>
<div> loopback interface." That's not how TCP listener sockets work: for any<br></div>
<div> given IP address, they guarantee single-process access to a port at any<br></div>
<div> one time. (Exceptions would include processes with root access, but an<br></div>
<div> attacking process with that level of access is going to be impossible to<br></div>
<div> defend against). While mostly harmless, the statement appears to be false<br></div>
<div> on its face, and should be removed or clarified.<br></div>
<div style="display:none;"><br></div>
</blockquote><div><br></div>
<div>Will be removed in the next update. Thank you.<br></div>
</blockquote><div><br></div>
<div>Actually, I disagree with Adam on this, because what he says is OS specific. So I think the text is valuable and should stay.<br></div>
<div><br></div>
</blockquote><div>In particular, I think SO_REUSEADDR socket option is widely implemented, both on Windows and Linux.<br></div>
<div><br></div>
</body>
</html>

--_----------=_149553415814050450--