Re: [secdir] Review of draft-brown-versioning-link-relations-05

[Eric Rescorla <[e-mail]>]

At Sun, 03 Jan 2010 19:22:27 +0100,
Julian Reschke wrote:
> 
> Eric Rescorla wrote:
> > This document describes a set of link relations which provide
> > information about other versions of a versioned resource.
> > 
> > In general this mechanism seems sound but I'm not sure that
> > the security considerations are entirely adequate. This 
> > mechanism lets you learn information about other versions
> > of a resource even if you potentially don't have permission
> > to view them directly. Consider a limiting case where each
> > version of the resource had a name that contained the
> > change set for that resource. E.g.,
> > 
> > http://example.com/versions/filename/_@line_50_+_FOO;@line_60_+_BAR/;
> > 
> > In this case, seeing other parts of the version tree leaks
> > information about those versions. I don't think that this
> > is a problem for the draft, but it might be useful to
> > mention that this feature has implications for name 
> > construction.
> 
> Yes, we can mention that.
> 
> But, isn't this a general problem with exposing meta data in link 
> relations? 

Yes, probably.


> As such, shouldn't it have been mentioned in RFC 4287, and 
> should it also be mentioned in draft-nottingham-http-link-header?

Probably... I just didn't read these. :) I only did this one as part
of secdir review. 

-Ekr