SECDIR Review: Section 10.4 - Clearer statement on the lack of endpoint identifiers needed

[Nat Sakimura]

This section ends with the statement “An extension specification should be created.” Presumably the intent here is to suggest that an extension is needed to remedy the vulnerability resulting from the lack of explicit endpoint identifiers. This should be more clearly stated.

[Nat Sakimura]

We know some of the vulnerabilities pointed out would not have happened if it were done. They were fixed another-way though. The sentence is pointing out that it is likely that there are other vulnerabilities that we do not know right now unless we do this. It is of the precautionary nature.

Perhaps changing the sentence like the following work?

An extension specification should be created as a preventive measure to address 
vulnerabilities that has not yet been identified.

[Nat Sakimura]

Re: #31.

→ <<cset 4555a6ca51c0>>