Public Comment

[comment-form@oasis-open.org]

Comment from: arshad.noor@strongauth.com

Name: Arshad Noor
Title: Founder & CEO
Organization: StrongAuth, Inc.
Regarding Specification:

While I am certainly glad that the specification allows for encrypted and/or signed content (in "embeddedXMLContent"), given the context under which this standard will be used, and given the possibility that chaos could result from spurious messages designed to elicit chaos, I would make the digital signatures mandatory within the protocol.

A case in point: Emulex, a publicly traded company briefly lost nearly $2.5 in market capitalization (http://news.com.com/2100-1033-244975.html?legacy=cnet).  While most of the value returned after trading resumed for the stock, some investors surely did not recover from this hoax.

Emergency messages will likely deal with life and death situations; it is far too important to be disemminated with unsigned messages.