[XML-DEV Mailing List Archive Home] [By Thread] [By Date] [Recent Entries] [Reply To This Message]

Re: Stick with XML ... JSON is a minefield of security risks a

  • From: Michael Kay <mike@saxonica.com>
  • To: "Costello, Roger L." <costello@mitre.org>
  • Date: Fri, 4 Nov 2016 15:54:50 +0000

Re:  Stick with XML ... JSON is a minefield of security risks a
I believe the main current RFC for email is RFC 8222, augmented by other standards such as MIME.

RFC 8222 doesn't read like a spec at all, it reads like advice and guidance. Just look at section 2.1.1 on line length limits for the kind of flavour. "This is what can go wrong if the line length exceeds 78 characters.... This is what can go wrong if it exceeds 998 characters...".

The spec is full of stuff like this:

Note: Some legacy implementations used the simple form where the
addr-spec appears without the angle brackets, but included the name
of the recipient in parentheses as a comment following the addr-spec.
Since the meaning of the information in a comment is unspecified,
implementations SHOULD use the full name-addr form of the mailbox,
instead of the legacy form, to specify the display name associated
with a mailbox.  Also, because some legacy implementations interpret
the comment, comments generally SHOULD NOT be used in address fields
to avoid confusing such implementations.

In other words, it's all about documenting the bugs in popular implementations of earlier standards.

Michael Kay
Saxonica

> On 4 Nov 2016, at 12:13, Costello, Roger L. <costello@mitre.org> wrote:
> 
> Michael Kay wrote:
> 
> 	When you compare it to the
> 	mess-that-calls-itself-a-standard
> 	by means of which this email
> 	reaches you, JSON is sparkling clean.
> 
> Fascinating statement!
> 
> Michael, what standard (or standards) are you referring to? Would you provide an example (or two) of how the standard(s) are underspecified please?
> 
> /Roger
> 
> 
> _______________________________________________________________________
> 
> XML-DEV is a publicly archived, unmoderated list hosted by OASIS
> to support XML implementation and development. To minimize
> spam in the archives, you must subscribe before posting.
> 
> [Un]Subscribe/change address: http://www.oasis-open.org/mlmanage/
> Or unsubscribe: xml-dev-unsubscribe@lists.xml.org
> subscribe: xml-dev-subscribe@lists.xml.org
> List archive: http://lists.xml.org/archives/xml-dev/
> List Guidelines: http://www.oasis-open.org/maillists/guidelines.php



[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index]


PURCHASE STYLUS STUDIO ONLINE TODAY!

Purchasing Stylus Studio from our online shop is Easy, Secure and Value Priced!

Buy Stylus Studio Now

Download The World's Best XML IDE!

Accelerate XML development with our award-winning XML IDE - Download a free trial today!

Don't miss another message! Subscribe to this list today.
Email
First Name
Last Name
Company
Subscribe in XML format
RSS 2.0
Atom 0.3
 

Stylus Studio has published XML-DEV in RSS and ATOM formats, enabling users to easily subcribe to the list from their preferred news reader application.


Stylus Studio Sponsored Links are added links designed to provide related and additional information to the visitors of this website. they were not included by the author in the initial post. To view the content without the Sponsor Links please click here.

Site Map | Privacy Policy | Terms of Use | Trademarks
Free Stylus Studio XML Training:
W3C Member
Stylus Studio® and DataDirect XQuery ™are products from DataDirect Technologies, is a registered trademark of Progress Software Corporation, in the U.S. and other countries. © 2004-2013 All Rights Reserved.