Re: [quicwg/base-drafts] Document request forgery (#3996)

[Lucas Pardue <[e-mail]>]

@LPardue commented on this pull request.



> +  to use source address spoofing to select where a server sends subsequent
+  datagrams.
+
+These three options all involve cases where an endpoint sends datagrams to a
+host that might not understand QUIC. That is, these packets are sent prior to
+address validation; see {{address-validation}}.
+
+Outside of the encrypted portion of packets, QUIC offers an endpoint several
+options for controlling the content of UDP datagrams that a peer sends. The
+Destination Connection ID field offers direct control over early bytes of every
+packet sent by a peer; see {{connection-id}}. The Token field in Initial
+packets offers a server control over other bytes of Initial packets; see
+{{packet-initial}}.
+
+There are no measures in the protocol to prevent indirect control over the
+encrypted portions of packets. it is necessary to assume that endpoints are

```suggestion
encrypted portions of packets. It is necessary to assume that endpoints are
```

> +Unlike other packets, packet protection provides good protection against
+control over the contents of Initial packets. The choice of an unpredictable
+Destination Connection ID by clients ensures that servers are unable to control
+any of the encryption portion of Initial packets.

This para's grammar hurts my head. Alternative might be

"Initial packet protection provides resilience to control of contents by servers. Client choice of an unpredictable Destination Connection ID ensures servers are unable to control any of the encrypted portion of Initial packets."

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3996#pullrequestreview-466797717