Subject: [Dbound] Discussion on Websec

From: Jeffrey Walton <[email-masked]>
Date: Sat, 9 Aug 2014 20:22:06 -0400

Not sure if anyone is watching, but this looks like its creeping into
(or overlapping with) dbound territory:

"[websec] cookie injection attack via superdomain of HSTS Host (was:
[Technical Errata Reported] RFC6797 (4075)",
http://www.ietf.org/mail-archive/web/websec/current/msg02144.html