ISSUE-23 (Key Indentifier Case): Should Key Identifiers prioritize uppercase characters [DOM3 Events]

2008-06-28 Thread Web Applications Working Group Issue Tracker
ISSUE-23 (Key Indentifier Case): Should Key Identifiers prioritize uppercase characters [DOM3 Events] http://www.w3.org/2008/webapps/track/issues/ Raised by: Doug Schepers On product: DOM3 Events In the current draft of Key Identifiers, including the new algorithm wording, there is a bias tow

Re: [AC] Hardening against DNS rebinding attacks - proposal

2008-06-28 Thread Jonas Sicking
Maciej Stachowiak wrote: On Jun 28, 2008, at 2:33 PM, Jonas Sicking wrote: Maciej Stachowiak wrote: On Jun 27, 2008, at 2:18 PM, Jonas Sicking wrote: What is the threat model this defends against? Since any server using Access-Control that does not check HOST is vulnerable to a convention

Re: [AC] Hardening against DNS rebinding attacks - proposal

2008-06-28 Thread Maciej Stachowiak
On Jun 28, 2008, at 2:33 PM, Jonas Sicking wrote: Maciej Stachowiak wrote: On Jun 27, 2008, at 2:18 PM, Jonas Sicking wrote: What is the threat model this defends against? Since any server using Access-Control that does not check HOST is vulnerable to a conventional XHR DNS rebinding atta

Re: [AC] Hardening against DNS rebinding attacks - proposal

2008-06-28 Thread Jonas Sicking
Maciej Stachowiak wrote: On Jun 27, 2008, at 2:18 PM, Jonas Sicking wrote: Hi All! There has been recent discussions about how DNS rebinding attacks affect Access-Control. As I have said in previous emails [1] Access-Control is currently no more prone to DNS rebinding attacks than the res

Re: How Open is Open?

2008-06-28 Thread Ian Hickson
On Fri, 27 Jun 2008, [someone] wrote [on the member-only list]: > > [many members of the working group, including Google, are not open > source companies] Open source or not, standards development should be done in the open. The very fact that this discussion isn't happening in the open is ex