FWIW I scanned the correspondence on ACTION-278 in preparation for Thursday's call. I can't say I've found enlightenment. But I did compile some of the bits I thought were interesting and/or important; see: http://www.w3.org/2001/tag/2010/02/action-278-notes.txt (if someone wants to htmlify so that the links can be followed that would be great) I say *some* of the bits because certainly it leaves out many bits that are important! It's in CVS so that others can add to it. (Sometimes I wish we had a wiki.) It appears there's consensus to change the finding, but not consensus on how. I think more analysis is needed (remember Larry saying we should continue in email?), especially regarding what CSRF defenses need to look like, whether they do / can / should satisfy Larry's risk mitigation and semi-confidentiality criteria. JonathanReceived on Wednesday, 17 February 2010 03:29:19 UTC
This archive was generated by hypermail 2.4.0 : Friday, 17 January 2020 22:56:33 UTC