[XML-DEV Mailing List Archive Home] [By Thread] [By Date] [Recent Entries] [Reply To This Message]

Re: Elliotte Rusty Harold on Web Services

• To: Uche Ogbuji <uche.ogbuji@f...>
• Subject: Re: Elliotte Rusty Harold on Web Services
• From: Daniel Veillard <veillard@r...>
• Date: Sun, 2 Feb 2003 11:17:08 -0500
• Cc: Mike Champion <mc@x...>, elharo@m..., xml-dev@l...
• In-reply-to: <E18fLlr-0005ZU-00@b...>; from uche.ogbuji@f... on Sun, Feb 02, 2003 at 08:10:59AM -0700
• References: <mc@x...> <E18fLlr-0005ZU-00@b...>
• Reply-to: veillard@r...
• User-agent: Mutt/1.2.5.1i

On Sun, Feb 02, 2003 at 08:10:59AM -0700, Uche Ogbuji wrote:
> > On the "XML community" critique, the way I see it is that the Web services 
> > people are pushing the XML envelope in ways it was not pushed before, and 
> > have found it wanting: Things like entity references play hell with 
> > efficient buffer management in high-performance parsers;
> 
> Silly rabbit, XML is for folks who want XML, not for folks who want "efficient 
> buffer management in high-performance parsers".  If everyone who found XML 

  Right, I think it's time to bite. If you want high speed parsing
don't use entities, okay. This mean don't use entities *in the instances*.
If you have troubles because of the time taken to compare the current char
and not take the associated branch to handle the "if" then I seriously
think you must change your parser implementation language, you have a serious
problem with your compiler or the way you implemented memory management !!!
  This is pure non-sense. Now, about being afraid of recursive entities
references in the internal subset leading to possible DoS, first
your service is still vulnerable to DoS with infinite input or high
rates of input request/data in completely similar ways, second if the
recursion frighten you simple put a guard for the depth of the recursion
like I did in libxml2, nobody ever complained about it and such recursion
is immediately detected and the parser halts with an error.
  I seriously think that at least those 2 arguments don't stand in the
face of real code engineering, especially if you follow basic good
coding practises. It doesn't mean that defining one subset of XML 
might not be a worthy exercise, but those justifications are IMHO
totally impropers to guide this work.
<blunt>
   Enough bullshit !
</blunt>

Daniel

-- 
Daniel Veillard      | Red Hat Network https://rhn.redhat.com/
veillard@r...  | libxml GNOME XML XSLT toolkit  http://xmlsoft.org/
http://veillard.com/ | Rpmfind RPM search engine http://rpmfind.net/

• References:
  • Re: Elliotte Rusty Harold on Web Services
    • From: Uche Ogbuji <uche.ogbuji@f...>

• Prev by Date: RE: Elliotte Rusty Harold on Web Services
• Next by Date: SML (was Elliotte Rusty Harold on Web Services)
• Previous by thread: Re: Elliotte Rusty Harold on Web Services
• Next by thread: SML (was Elliotte Rusty Harold on Web Services)
• Index(es):
  • Date
  • Thread