Subject: [Speechsc] mrcpv2-01: Security Considerations and URI's

From: "Eric Burger" <[email-masked]>
Date: Fri, 30 Jan 2004 16:05:15 -0500

The document needs a security considerations section.

The protocol allows for fetching by reference.  We need to point out the potential for attack amplification (one MRCPv2 request generating lots of fetches) -- both on the server itself and as a platform for a DDoS attack.

How do we want to handle URI's.  For interoperability, we should mandate certain schemas.  I would vote for http being a MUST implement and https being a SHOULD.  Is the requirement for http too strong?

What happens if the server does not support the URI scheme?  E.g., a file://mumble/foo or ftp://mumble/foo?  What if the scheme doesn't make sense, e.g., tel:3211234567?

URI's appear in the Synthesizer Speech Data fetch list (S 7.5), Waveform URL (S 8.4)

_______________________________________________
Speechsc mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/speechsc