Re: [secdir] Secdir review of draft-murchison-nntp-compress-05

[Julien ÉLIE <[e-mail]>]

Hi Barry,

> I've been thinking on this since you mentioned it, and I have mixed
> feelings.  So let me spread them out here:
[...]
> And on the third hand (I'm Martian)
> On the fourth hand (and that's all that Martians have)

I like these two introductions of alternatives :)


> So, yes: in the end, I think it's worth putting in a few words about
> this, just to be clear that it's a common trap.

OK.
FYI, I've added the following paragraph at the end of the Security 
Considerations Section.  The wording is inspired by the one in RFC 3749.

    Last but not least, careful consideration should be given to
    protections against implementation errors that introduce security
    risks with regards to compression algorithms.  See for instance the
    part of Section 6 of [RFC3749] about compression algorithms that can
    occasionally expand, rather than compress, input data.

-- 
Julien ÉLIE

« Aut bibas aut abeas. »