Subject: RE: [Ltru] Re: [psg.com #944] MAY a conformant implementation imp oselength constraints?

From: "McDonald, Ira" <[email-masked]>
Date: Wed, 1 Jun 2005 12:10:05 -0700

Hi,

Then, I'd suggest changing:

"specification of valid subtags for an extension"

to:

"specification of valid subtags for an extension (see section 2.2.6)"

Cheers,
- Ira

Ira McDonald (Musician / Software Architect)
Blue Roof Music / High North Inc
PO Box 221  Grand Marais, MI  49839
phone: +1-906-494-2434
email: [email-masked]

> -----Original Message-----
> From: Addison Phillips [mailto:[email-masked]]
> Sent: Wednesday, June 01, 2005 3:04 PM
> To: McDonald, Ira; Doug Ewell; LTRU Working Group
> Subject: RE: [Ltru] Re: [psg.com #944] MAY a conformant implementation
> imposelength constraints?
> 
> 
> No, this is extensions, which are separately defined. This 
> sentence was added as part of a previous comment about denial 
> of service attacks on registries in general. 
> 
> Addison
> 
> Addison P. Phillips
> Globalization Architect, Quest Software
> Chair, W3C Internationalization Core Working Group
> 
> Internationalization is not a feature.
> It is an architecture. 
> 
> > -----Original Message-----
> > From: McDonald, Ira [mailto:[email-masked]]
> > Sent: mercredi 1 juin 2005 12:00
> > To: Addison Phillips; McDonald, Ira; Doug Ewell; LTRU Working Group
> > Subject: RE: [Ltru] Re: [psg.com #944] MAY a conformant 
> implementation
> > imposelength constraints?
> > 
> > Hi,
> > 
> > I agree with Randy's proposed tightening of the length section.
> > 
> > In the security section, I'm not sure what is meant by the last
> > sentence:
> > 
> > "Although the specification of valid subtags for an 
> extension MUST be
> > available over the Internet, implementations SHOULD NOT mechanically
> > depend
> > on it being always accessible, to prevent denial-of-service 
> attacks."
> > 
> > Is that 'specification' the IANA Language Subtag Registry?  
> If so, we
> > should
> > say that explicitly.  If not, we should be clearer.
> > 
> > Cheers,
> > - Ira
> > 
> > Ira McDonald (Musician / Software Architect)
> > Blue Roof Music / High North Inc
> > PO Box 221  Grand Marais, MI  49839
> > phone: +1-906-494-2434
> > email: [email-masked]
> > 
> > > -----Original Message-----
> > > From: Addison Phillips [mailto:[email-masked]]
> > > Sent: Wednesday, June 01, 2005 12:57 PM
> > > To: Addison Phillips; McDonald, Ira; Doug Ewell; LTRU 
> Working Group
> > > Subject: RE: [Ltru] Re: [psg.com #944] MAY a conformant 
> implementation
> > > imposelength constraints?
> > >
> > >
> > > See:
> > > 
> http://www.inter-locale.com/ID/draft-ietf-ltru-registry-03.html#length
> > >
> > > And:
> > > http://www.inter-locale.com/ID/draft-ietf-ltru-registry-03.htm
> > > l#security
> > >
> > >
> > > Addison
> > >
> > > Addison P. Phillips
> > > Globalization Architect, Quest Software
> > > Chair, W3C Internationalization Core Working Group
> > >
> > > Internationalization is not a feature.
> > > It is an architecture.
> > >
> > > > -----Original Message-----
> > > > From: [email-masked]
> > > [mailto:[email-masked]] On
> > > > Behalf Of Addison Phillips
> > > > Sent: mercredi 1 juin 2005 09:37
> > > > To: McDonald, Ira; Doug Ewell; LTRU Working Group
> > > > Subject: RE: [Ltru] Re: [psg.com #944] MAY a conformant
> > > implementation
> > > > imposelength constraints?
> > > >
> > > > Okay, here's what I'm doing:
> > > >
> > > > 1. I'm rewriting the security considerations section, since
> > > the text that
> > > > says "the only consideration" is increasingly odd.
> > > >
> > > > 2. I'm inserting a version of Randy's text. The problem
> > > with Randy's text
> > > > is that it doesn't fully explain the problem (where the
> > > length can come
> > > > from).
> > > >
> > > > 3. WRT Ira's comments, RFC3066bis tags won't be that much
> > > longer for the
> > > > reasons stated in Section 2.1.1 (Length Considerations):
> > > although there is
> > > > no limit on the number of variants and so on, the
> > > recommended prefixes and
> > > > other guidance in the registry means that useful tags will
> > > be limited, in
> > > > general, to just four subtags plus private use. I am adding
> > > some text to
> > > > Section 2.1.1 explaining this in detail (the gist of it 
> is that the
> > > > smallest buffer limit that will not be exceeded by a
> > > practical tag is 58
> > > > bytes and a buffer limit of 64 is therefore advised and that
> > > > implementations that are limited in this manner should truncate
> > > > extensions).
> > > >
> > > > Addison
> > > >
> > > > Addison P. Phillips
> > > > Globalization Architect, Quest Software
> > > > Chair, W3C Internationalization Core Working Group
> > > >
> > > > Internationalization is not a feature.
> > > > It is an architecture.
> > > >
> > > > > -----Original Message-----
> > > > > From: [email-masked]
> > > [mailto:[email-masked]]
> > > > On
> > > > > Behalf Of McDonald, Ira
> > > > > Sent: mercredi 1 juin 2005 08:51
> > > > > To: 'Doug Ewell'; LTRU Working Group
> > > > > Subject: RE: [Ltru] Re: [psg.com #944] MAY a conformant
> > > implementation
> > > > > impose length constraints?
> > > > >
> > > > > Hi,
> > > > >
> > > > > I support Randy's suggested update to Security 
> Considerations too.
> > > > >
> > > > > I still think it would be good to specify a lower 
> bound of length
> > > > > for language tags that SHOULD be supported by conforming
> > > implementations.
> > > > > Because in the RFC3066bis real-world language tags may
> > > very well be much
> > > > > longer than the classic 'll-CC'.
> > > > >
> > > > > Cheers,
> > > > > - Ira
> > > > >
> > > > > Ira McDonald (Musician / Software Architect)
> > > > > Blue Roof Music / High North Inc
> > > > > PO Box 221  Grand Marais, MI  49839
> > > > > phone: +1-906-494-2434
> > > > > email: [email-masked]
> > > > >
> > > > > > -----Original Message-----
> > > > > > From: [email-masked]
> > > > > > [mailto:[email-masked]]On
> > > > > > Behalf Of Doug Ewell
> > > > > > Sent: Tuesday, May 31, 2005 11:50 PM
> > > > > > To: LTRU Working Group
> > > > > > Subject: [Ltru] Re: [psg.com #944] MAY a conformant
> > > implementation
> > > > > > impose length constraints?
> > > > > >
> > > > > >
> > > > > > Randy Presuhn <randy underscore presuhn at mindspring
> > > dot com> wrote:
> > > > > >
> > > > > > >> Won't work: Variants and private use subtags are not
> > > bounded in
> > > > > > >> number. Neither can extension lengths be known 
> in advance.
> > > > > > >
> > > > > > > Then I think we really need to add something like the
> > > > > > following to the
> > > > > > > security considerations section, as part of this issue's
> > > > > > resolution /
> > > > > > > rejection:
> > > > > > >
> > > > > > > Since there is no limit to the number of variant and
> > > private use
> > > > > > > subtags, and consequently no limit on the possible
> > > length of a tag,
> > > > > > > implementations need to guard against buffer overflow
> > > attacks.  See
> > > > > > > section ## for details on tag truncation, which 
> can occur as a
> > > > > > > consequence of defenses against buffer overflow.
> > > > > >
> > > > > > Yes.  Excellent.
> > > > > >
> > > > > > --
> > > > > > Doug Ewell
> > > > > > Fullerton, California
> > > > > > http://users.adelphia.net/~dewell/
> > > > > >
> > > > > >
> > > > > >
> > > > > > _______________________________________________
> > > > > > Ltru mailing list
> > > > > > [email-masked]
> > > > > > https://www1.ietf.org/mailman/listinfo/ltru
> > > > > >
> > > > >
> > > > > _______________________________________________
> > > > > Ltru mailing list
> > > > > [email-masked]
> > > > > https://www1.ietf.org/mailman/listinfo/ltru
> > >
> > >
> > >
> 
> 

_______________________________________________
Ltru mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ltru