At 2:30 AM -0400 5/21/05, Bob Wyman wrote:
I think it would be both wise and appropriate to provide text in a Security Concerns section that describes the vulnerability of systems that rely on Atom documents to this particular attack.
That's why we have signed documents, which are described fully in the document already. It is fine to add text to the signatures section explaining why they are useful against this attack, and a short mention in the Security Considerations section pointing back to that one.
Please note that every format that the IETF has ever come out with that isn't inherently signed has either this exact problem or one very close to it. The fact that the format document specifies a signing mechanism in the document itself instead of in a companion document that is read by only 25% of the implementers is a giant leap forward.
--Paul Hoffman, Director --Internet Mail Consortium
