W3C home > Mailing lists > Public > xml-dist-app@w3.org > July 2001

Re: A tale of two bindings

From: Rich Salz <rsalz@zolera.com>
Date: Wed, 25 Jul 2001 09:50:57 -0400
Message-ID: <3B5ECEC1.267F62D0@zolera.com>
To: mark.baker@sympatico.ca
CC: xml-dist-app@w3.org
> While we can't stop anybody from tunneling, we should certainly aim
> to provide a binding that makes it cheap and easy for tunneling to
> be detected.  To not do so would be to commit a major security
> faux pas.

Not at all.  The faux pas is to assume that potentially dangerous
traffic is labelled.  We should be encouraging proper security design,
which means the responsibility is at the receiving entity.  The current
state of the art -- "gee I hope to heck nobody breaches my firewall" --
is cave-painting, not security.
	/r$

-- 
Zolera Systems, Securing web services (XML, SOAP, Signatures,
Encryption)
http://www.zolera.com
Received on Wednesday, 25 July 2001 09:49:38 GMT

This archive was generated by hypermail 2.2.0+W3C-0.50 : Monday, 7 December 2009 10:59:03 GMT