Re: service.notify?

[Gary Burd <gary@xxxxxxxxxxxxxxxx>]

On Jan 11, 2004, at 11:14 AM, petite_abeille wrote:

> > One denial of service attack is to register hundreds of URLs at a 
> > victim's site with hundreds of notification centers.
>
> At worst, your site goes under. No big loss there. A blog is not a 
> critical piece of infrastructure last time I checked.

Notification centers can be directed to hit any host on the internet.  
The host need not be hosting a blog or even be running a web server.  
Because the notifications do not include any information about the 
notification center, there does not appear to be an easy way for a 
victim to discover the notification centers hitting his host so that he 
can put a stop to an attack

On Jan 11, 2004, at 10:43 AM, petite_abeille wrote:

> > 4) How does one unsubscribe?
>
> There should be a corresponding DELETE method.

What stops an attacker from unregistering other users?  This attack can 
be automated using blogroll formats discussed elsewhere on this list.