[XML-DEV Mailing List Archive Home] [By Thread] [By Date] [Recent Entries] [Reply To This Message]

Re: Excellent IETF BCP on XML

• To: XML Dev <xml-dev@l...>
• Subject: Re: Excellent IETF BCP on XML
• From: Miles Sabin <miles@m...>
• Date: Mon, 16 Dec 2002 13:39:03 +0000
• In-reply-to: <3DFDCF22.7090801@p...>
• References: <B885BEDCB3664E4AB1C72F1D85CB29F8040EF7D9@R...> <200212160902.26956.miles@m...> <3DFDCF22.7090801@p...>

Paul Prescod wrote,
> Miles Sabin wrote:
> > But my point still stands. It isn't just clients executing
> > retrieved "active" content that represents a risk: flaws in the
> > clients implementation of the base protocol can be just as
> > dangerous.
>
> True, but true also of any other protocol all the way down to IP or
> Ethernet.

Agreed ... tho' by and large the lower down the stack you go, the more 
mature the code, so the less likelihood (nb. only less _likelihood_) 
there is of undiscovered flaws.

> Let's just say that HTTP GET is as safe as it is possible for a
> network operation to be.

You can only say that relative to a particular implementation.

I think we're all used to the idea that servers have to be coded 
defensively. And we're all aware that interactive clients which execute 
active content need to be coded defensively too. But servers which also 
act as non-interactive clients are less commonplace, and to the extent 
that they're thought about at all, there might be a temptation to 
assume that because they don't typically execute active content 
automatically they're relatively safe. I don't think that's a safe 
assumption, and the wget vulnerability illustrates why it isn't.

> > So how much do you trust the implementations of the network clients
> > you use? Do you trust them enough to have a process feed them
> > arbitrary  URIs for dereferencing while left unattended?
>
> Google and Alta Vista do, with no apparent ill effects.

I would hope that Google and Altavista audit their, presumably custom, 
network client implementations thoroughly and continuously given how 
central unattended clients are to their business.

I'm less hopeful that others will be as scrupulous as necessary ... 
particularly if they're unware, or only hazily aware, that they're 
operating unattended network clients at all. That's why I'm so 
excitable about off the shelf XML parsers which default to 
dereferencing external entities, and proposals which might encourage 
the dereferencing of URIs which weren't previously thought of as 
typically being usefully dereferencable non-interactively (ie. 
namespace identifiers).

Cheers,


Miles

• References:
  • Re: Excellent IETF BCP on XML
    • From: Miles Sabin <miles@m...>
  • Re: Excellent IETF BCP on XML
    • From: Paul Prescod <paul@p...>

• Prev by Date: Re: XML2002 Conference in Baltimore?
• Next by Date: Re: nested namespaces
• Previous by thread: Re: Excellent IETF BCP on XML
• Next by thread: RE: xml-dev@l...
• Index(es):
  • Date
  • Thread