Content based detection out of scope (Was: What problems are we trying to solve?)

I've updated the "Out of scope" section at:

http://www.w3.org/2006/WSC/wiki/NoteOutOfScope

to summarize the two bullet points:

 * Code based techniques to detect spoofing attacks such as cross site
comparisons of URL or graphical similiarity. 
 * Calculations, algorithms, and functions that attempt to determine
whether or not an attack is underway, including intrusion or virus
detection techniques, such as sense of self and "signature" of known
attacks.

And turned them into the "Out of scope" section:

"""
Content based detection

Techniques commonly used by intrusion detection systems, virus checkers
and spam filters to detect illegitimate requests based on their content
are out of scope for this Working Group. These techniques include
comparing the served URLs, graphics or markup to known legitimate sites,
or to known attacks. The heuristics used in these tools are a moving
target and so not a suitable subject for standardization. The working
group will not recommend any checks on the content served by web sites.
"""

I think this text reflects the conversation we just had on the
tele-conference. There's still the issue of whether or not the display
of the results of these out-of-scope techniques is in-scope. I have
doubts that it's a good idea to sanction these techniques, since they
have the effect of making content that is valid according to a content
specification, illegal in practice. It might be an anti-pattern to break
content specifications in this way. It might be worth pinging the TAG on
this issue.

Tyler

Received on Tuesday, 12 December 2006 17:54:22 UTC