The Postel Principle Patch: --- ietf/postels-principle +++ ietf/postels-principle - Be liberal about what you accept. + Be definite about what you accept.(*) + + Treat inputs as a language, accept it with a matching computational + power, generate its recognizer from its grammar. + + Treat input-handling computational power as privilege, and reduce it + whenever possible. + + + (*) For the sake of your users, be definite about what you accept. + Being liberal worked best for simpler protocols and languages, + and is in fact limited to such languages; be sure to keep your + language regular or at most context free (no length fields). + Being more liberal did not work so well for early IPv4 stacks: + they were initially vulnerable to weak packet parser attacks, and + ended up eliminating many options and features from normal use. + Furthermore, presence of these options in traffic came to be regarded + as a sign of suspicious or malicious activities, to be mitigated by + traffic normalization or outright rejection. At current protocol + complexities, being liberal actually means exposing the users of your + software to intractable or malicious computations.