Conversation

Notices

1. John Drinkwater Kroc Camen

   @kroc_camen ’course not, one is push, one is pull. pubsubhubbub at risk from similar stunts, could subpoena the hub…

   Sunday, 09-Jan-11 17:27:25 UTC from xmpp
   • Julien Genestoux

     @johndrinkwater But the hub can very easily be changed without the user even knowing about :)

     Sunday, 09-Jan-11 17:29:10 UTC
   • John Drinkwater Julien Genestoux

     @julien thats even worse! How can you trust data from PuSH, then? based on a cookie concept iirc

     Sunday, 09-Jan-11 18:07:02 UTC
   • Julien Genestoux

     @johndrinkwater You should probably read the spec! Of course it's "secure" and you cna trust the data coming from a hub!

     Sunday, 09-Jan-11 18:10:55 UTC
   • John Drinkwater Julien Genestoux

     @julien seems a bit wishy-washy → ‘hub.secret… This parameter SHOULD only be specified when the request was made over HTTPS’ not MUST? #mitm

     Sunday, 09-Jan-11 18:19:04 UTC
   • John Drinkwater Julien Genestoux

     @julien but you’re right, #PuSH can be trusted when every implementor does the right thing.

     Sunday, 09-Jan-11 18:20:07 UTC