[XML-DEV Mailing List Archive Home] [By Thread] [By Date] [Recent Entries] [Reply To This Message]

Re: Excellent IETF BCP on XML

• To: XML Dev <xml-dev@l...>
• Subject: Re: Excellent IETF BCP on XML
• From: Miles Sabin <miles@m...>
• Date: Fri, 22 Nov 2002 22:29:58 +0000
• In-reply-to: <15725CF6AFE2F34DB8A5B4770B7334EE0DF8DE@h...>
• References: <15725CF6AFE2F34DB8A5B4770B7334EE0DF8DE@h...>

Bullard, Claude L (Len) wrote,
> Tim Bray assured us on the www-tag list that the namespace UR:/URI in
> no way is a security issue and cited his experience with security
> agencies of the US Government.   I gotta believe they thought about
> this.

Why?

OK, maybe US government security agencies have, but what about everyone 
else?

> In effect, the protocol designer has to specify what is to be done
> via automagic dereferencing as URIs are always dereferenceable.

Right, but protocols with security flaws aren't exactly unknown. And 
even if the protocol nails everything down precisely, there are buggy 
implementations. And even if an implementation is perfect, it's 
environment might not be ... a teensy bit of DNS cache poisioning can 
turn a harmless seeming URI into a dangerous one.

Cheers,


Miles

• References:
  • RE: Excellent IETF BCP on XML
    • From: "Bullard, Claude L (Len)" <clbullar@i...>

• Prev by Date: Re: XHTML and OpenOffice
• Next by Date: RE: XHTML and OpenOffice
• Previous by thread: RE: Excellent IETF BCP on XML
• Next by thread: Re: Excellent IETF BCP on XML
• Index(es):
  • Date
  • Thread