Re: [quicwg/base-drafts] Move security-critical client requirement on push to definitive sections (#4101)

Mike Bishop <notifications@github.com> Thu, 17 September 2020 18:51 UTC

Date: Thu, 17 Sep 2020 11:51:13 -0700
From: Mike Bishop <notifications@github.com>
Reply-To: quicwg/base-drafts <reply+AFTOJK45P4PB7A7L6P4CGN55N6ISDEVBNHHCTXJFEM@reply.github.com>
To: quicwg/base-drafts <base-drafts@noreply.github.com>
Cc: Subscribed <subscribed@noreply.github.com>
Message-ID: <quicwg/base-drafts/issues/4101/694430555@github.com>
In-Reply-To: <quicwg/base-drafts/issues/4101@github.com>
References: <quicwg/base-drafts/issues/4101@github.com>
Subject: Re: [quicwg/base-drafts] Move security-critical client requirement on push to definitive sections (#4101)
Mime-Version: 1.0
Content-Type: multipart/alternative; boundary="--==_mimepart_5f63b021570ac_57ea19f0217162"; charset="UTF-8"
Content-Transfer-Encoding: 7bit
Precedence: list
Archived-At: <https://mailarchive.ietf.org/arch/msg/quic-issues/ZUItKyXqS-trV9CHKpgPKHLPKCw>

The reason it's only a cancel push is that the server can't know with certainty for which origins the client considers it authoritative.  The server only knows for which origins *it* believes that it's authoritative.  So having received a push the client considers out-of-bounds, the client can't know for sure whether it's a poisoning attempt or simply a difference in view.

Yes, I think this is editorial, since the core request is to relocate existing text without changing the normative requirements.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/4101#issuecomment-694430555

[quicwg/base-drafts] move security-critical clien… Roy T. Fielding
Re: [quicwg/base-drafts] Move security-critical c… Mike Bishop
Re: [quicwg/base-drafts] Move security-critical c… Mike Bishop