On Thu, 04 Nov 2004 10:28:49 -0500, Robert Sayre <[EMAIL PROTECTED]> wrote:
>
> Tim Bray wrote:
>
> >
> > Having read the eight follow-ups, I'm really unconvinced. I'm pretty
> > sure that if I were malicious and wanted to DOS some Atom
> > implementation, there are easier ways than what you propose. And
>
> It's not about DOSing an Atom implementation. It's about exploiting any
> HTTP server with an insecure POST handler through an Atom client. Using
> POST for PaceServiceError is completely irresponsible.
Ok, I think, after 6 or 7 follow-ups I think I finally see a problem.
Here is a scenario:
Malicious user X produces an Atom feed served with an
X-Atom-Error header.
Malicious user X could change their X-Atom-Error header to point
to someone elses URI (it could be /their/ Error URI or it could
be a completely different service). Either way Malicious user
X then intentionally forces their Atom feed to be invalid, thus
causing all the subscribers to X Atom's feed to hit that
unrelated service.
Am I understanding the scenario correctly?
>
> > inventing new HTTP verbs is really questionable.
>
> That's the subtext of all the arguments for POST, I think.
No, the subtext was you didn't explain yourself very well.
> Unfortunately, it's not really backed by anything other than religion.
> It's also humorous to me that most of the people who feel that way have
> no problem with inventing new verbs by extending HTTP with custom headers.
>
> Robert Sayre
-joe
--
Joe Gregorio http://bitworking.org
