Re: [ebxmlms-develop] Paranoid security request

[Ng C. Y. [Cyng] <cy...@cs...>]

Hello,

> Can the Utility.generateMessageId() method please be changed to not use the
> IP address of the system.
>
> Using this address leaks information to the outside world about the internal
> network that the system is connected to.
>
> RFC2822 says "Though other algorithms will work, it is RECOMMENDED that the
> right hand side contain some domain identifier (either of the host itself or
> otherwise)", so the IP address is not mandatory. Something like the hostname
> by default, or a specified string, would be better.

        We decide to add the generateMessageId() method with a specified
host domain in the coming release.

Regards,
CY

----------------------------------------------------------------------------
Ng Chi Yuen, CY.       cy...@ce...       http://www.cecid.hku.hk/
Technology Officer,
Centre for E-Commerce Infrastructure Development,
The University of Hong Kong
----------------------------------------------------------------------------