- From: Tim Hollebeek via Datatracker <noreply@ietf.org>
- Date: Tue, 30 Jul 2024 10:59:07 -0700
- To: <secdir@ietf.org>
- Cc: draft-ietf-httpbis-zstd-window-size.all@ietf.org, ietf-http-wg@w3.org, last-call@ietf.org
Reviewer: Tim Hollebeek Review result: Ready This is rather unimportant, but I just wanted to mention it in case the authors find it useful. Feel free to ignore. The document states that there are no new security considerations, but that's perhaps not quite true. I think it might be useful to call out that an implementation cannot rely on its peer behaving correctly, so implementers will have to take into account they may still receive oversized frames from misbehaving clients. This is arguably no different from the situation today, so it can be argued that the current considerations are accurate. I just thought it might be useful to call it out so some engineer doesn't remove validation checks since the other side is supposed to behave now. Just because we have standards, doesn't mean that everyone complies.
Received on Tuesday, 30 July 2024 17:59:12 UTC