Subject: [secdir] SecDir review for draft-bryan-metalink

From: Paul Hoffman <[email-masked]>
Date: Mon, 20 Oct 2008 19:59:31 -0700

I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG.  These comments were written primarily for the benefit of the security area directors.  Document editors and WG chairs should treat these comments just like any other last call comments.                                            

The statement at the beginning of section 6 is correct and complete:

   Because Metalink is an XML-based format, existing XML security
   mechanisms can be used to secure its content.

That is, this is a fine example of "take this content and bag it with a standard security wrapper".

I don't see any other security issues specific to "these are files you want to download". Dangerous content in the files is really no different than dangerous content on a web page, for example.

On a non-security note, I hate the content of the reference for [BITTORRENT], but I cannot suggest a better one. If the BitTorrent people don't want to make their reference stable, we just have to suck it up.

--Paul Hoffman, Director
--VPN Consortium
_______________________________________________
secdir mailing list
[email-masked]
https://mailman.mit.edu/mailman/listinfo/secdir
_______________________________________________
secdir mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/secdir