Re: [quicwg/base-drafts] Is path validation a SHOULD or a MUST -- pick one! (#2580)

[erickinnear <[e-mail]>]

I think elsewhere we had a "MUST, unless" for some of this, so sticking with that would be great (to second Igor and Ian's comments).

Re: SHOULD, agreed that it would potentially broaden the attack surface, since some of the mitigations (the reason for the MUST in 9.2) rely on validation being performed.

The attacker can cause you to generate validation packets by injection, but I think the discussion in #2582 should attempt to consider the implications of what happens when you end up validating on every incoming packet (the worst possible case here, and definitely a good thing to think about).

My intent here is to put the non-editorial changes in a small PR to get the normative language right and then potentially follow with a larger PR that's (hopefully) purely editorial that rearranges these to get rid of some of the confusion around having requirements split across the sections.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2580#issuecomment-484236423