RE: REMINDER: RADEXT WG Last call on "Extended RADIUS Attributes"

["Glen Zorn" <glenzorn@comcast.net>]

Alan DeKok [mailto:aland@deployingradius.com] writes:

> Glen Zorn wrote:
> >> Alan's wording "The More Flag MUST NOT be set if the Length is less
> >> than
> >> 255." sounds good to me.
> >
> > My point was that making these kinds of rules is pointless: if
> someone wants
> > to split "Hello" into 5 separate attributes they either have a very
> good
> > reason to do so that none of us can foresee or they will soon be
> finding
> > gainful employment in a different field.  In any case, it's not
> possible to
> > protect people from their own stupidity (besides, they could still do
> it
> > with tags).
> 
>   It's only one sentence.  

A sentence here, a sentence there & pretty soon you're outlawing driving
while blindfolded (http://www.whatcar.com/news-article.aspx?NA=229117)...

> And it will stop the stupid people from
> afflicting everyone else.

No, they can still do it (even more stupidly) with tags...

> 
>   RFC 2865 has comments saying:
> 
>       The secret MUST NOT be empty (length 0) since this would allow
>       packets to be trivially forged.
> 
>   Which were inserted because of real-world exposure to implementations
> having *no* configuration for shared secrets. (i.e. they were always
> NUL).

That may be stupid, or not, depending upon the level of other security in
the network...

> 
>   Alan DeKok.



--
to unsubscribe send a message to radiusext-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://psg.com/lists/radiusext/>