Re: [Server-devel] Antitheft: sending a fake stolen...

2009-08-24 Thread C. Scott Ananian
On Mon, Aug 24, 2009 at 6:05 PM, Martin Langhoff wrote: > On Mon, Aug 24, 2009 at 11:45 PM, C. Scott Ananian wrote: >> so you should probably return a >> lease which is valid except for the fact that the signed string has an >> randomly-chosen UUID > > Exactly my thoughts -- as you can see in the b

Re: [Server-devel] Antitheft: sending a fake stolen...

2009-08-24 Thread Martin Langhoff
On Mon, Aug 24, 2009 at 11:45 PM, C. Scott Ananian wrote: > so you should probably return a > lease which is valid except for the fact that the signed string has an > randomly-chosen UUID Exactly my thoughts -- as you can see in the bug. Implementing that goes beyond merely coding it -- it would m

Re: [Server-devel] Antitheft: sending a fake stolen...

2009-08-24 Thread C. Scott Ananian
On Mon, Aug 24, 2009 at 6:37 AM, Martin Langhoff wrote: > A while ago, Daniel fixed a bug in my changes to olpc-update, and that > left me with a to-do item on the xs-activation side. > > Reviewed the situation on the OAT proto concept of always sending a > stolen token, with the idea that xs-activ

[Server-devel] Antitheft: sending a fake stolen...

2009-08-24 Thread Martin Langhoff
A while ago, Daniel fixed a bug in my changes to olpc-update, and that left me with a to-do item on the xs-activation side. Reviewed the situation on the OAT proto concept of always sending a stolen token, with the idea that xs-activation should do what the protocol proposes: always send a 'stolen