Re: [tcpm] tcp-security: Request for feedback on the outline of the document

[Joe Touch <[e-mail]>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1



Lars Eggert wrote:
> On 2009-9-3, at 20:40, Fernando Gont wrote:
> So if this is entirely aimed at implementers shouldn't that be
>>> explicitly stated in the title? I appreciate that in theory BCP is meant
>>> to imply implementation guidance but this might be more appropriately
>>> titled something like "Implementers guidelines for mitigating TCP
>>> security threats" or "Guidance on secure implementation of TCP"
>>
>> Point taken. How about "Guidance on secure implementation of the
>> Transmission Control Protocol (TCP)"?
> 
> Personally, I'd avoid the word "secured" in the title and maybe in other
> places in the document. Maybe use "hardened" or "robust" or
> "attack-resistant" or something, but "secure" isn't quite accurate

Guidance to Mitigate TCP Implementation-Based Vulnerabilities

This makes more sense to me if this is indeed focused on
implementation-based vulnerabilities, rather than general security threats

If this is all the ways an implementer can avoid security threats in
general, then I reiterate my suggestion that we need a security
vulnerabilities doc.

Joe
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAkqgVE4ACgkQE5f5cImnZrvXfwCdGZNJw5Wr0KsxR2N8zf0gADzQ
mrIAn3/Tpr6tAazbnzX3tD80qQFLihrP
=lejH
-----END PGP SIGNATURE-----