Re: [hrpc] HTTP status code for "access blocked to protect you against malware/phishing/etc"?

On Nov 20, 2017, at 6:37 AM, Stephane Bortzmeyer <bortzmeyer@nic.fr <mailto:bortzmeyer@nic.fr>> wrote:
> The only draft I've found about this specific idea is
> <https://datatracker.ietf.org/doc/draft-lemon-tls-blocking-alert/ <https://datatracker.ietf.org/doc/draft-lemon-tls-blocking-alert/>>,
> but it is TLS-specific.

I stopped pushing this after David Oran pointed out that there's no way to authenticate who is making the claim about why the content was blocked.   I think this is a bit of a flaw in the 451 code idea as well—if it's not signed by whoever is claiming authority to do the block, it can be used to tell the end user something that is not true and can be turned into an attack on whomever the blocking is attributed to.