5 ms·
> this is pretty much a list of implementation flaws, not protocol flaws I can agree with that but problems outlined are very common so it doesn't really matte
by homakov 12y ago
> this is pretty much a list of implementation flaws, not protocol flaws
I can agree with that but problems outlined are very common so it doesn't really matter. Say, Facebook is major oauth2 provider and doesn't follow most of the spec. As well as lots of popular libraries.
- ademarre 12y agoYou're probably right; spec conformance is a problem. What should be done about it? If the spec itself isn't all that bad, then we should try to improve implementations. Maybe tools can be developed to help detect implementation flaws. Or if the letter of the spec is the problem, but the protocol/framework itself is good, then why not rewrite an alternative spec, similar to what was done recently for HTTP/1.1?
- Confusion 12y agoThe spec should be robust against the possibility of implementation errors that result in the system being less secure. This is distinct from the possibility of implementation errors that simply result in the code not working at all or being obviously broken. You can't prevent those, but you also don't need to. The point is that subtle implementation errors should be ruled out as much as possible. This is a common criterion in cryptography, against which systems and primitives are judged.