[XSL-LIST Mailing List Archive Home] [By Thread] [By Date] [Recent Entries] [Reply To This Message] Re: Fw: Signing of XSL scripts
Gavin Nicol wrote: > > Even authentication isn't enough. Having an arbitrary scripting language > opens you to denial of serive attacks, and other such things. An infinitely looping JavaScript program in a web page does not hang the computer, it only hangs the browser. You just kill the browser and start again. I suppose you can call this "denial of service" since you are denied from using the browser session you were using before, but that is quite a trivial service denial. With multithreading, you don't even need to allow that. The "stop" button could kill the XSL thread, just as it kills the download thread if some idiot tries to trick you into downloading his memory image as an image. > What is needed is some way for the XSL processor to be able > to "prove" correctness. Sounds like the halting problem to me. We can't accomplish that and we don't need it. What we need is reliable software with functional "stop" buttons. Paul Prescod - http://itrc.uwaterloo.ca/~papresco Three things never trust in: That's the vendor's final bill The promises your boss makes, and the customer's good will http://www.geezjan.org/humor/computers/threes.html XSL-List info and archive: http://www.mulberrytech.com/xsl/xsl-list
|
PURCHASE STYLUS STUDIO ONLINE TODAY!Purchasing Stylus Studio from our online shop is Easy, Secure and Value Priced! Download The World's Best XML IDE!Accelerate XML development with our award-winning XML IDE - Download a free trial today! Subscribe in XML format
|