3 ms·
This is terrible advice. Exposing any public endpoint that talks XML is a security disaster in waiting and the fact that the author makes no mention of a long h
by patrec 6y ago
This is terrible advice. Exposing any public endpoint that talks XML is a security disaster in waiting and the fact that the author makes no mention of a long history of major security vulnerabilities in popular XML packages does no credit to him.
The "composable" without "confusion about semantics" is a joke, too: in practice it's not even possible to know what whitespace means. Is it semantically meaningful or just there for pretty printing? Also, say you see a commented out region in an XML file. How do you uncomment it? If XML where less braindamaged both problems would be trivial and purely mechanical. In practice you'll generally have to guess.
All in all XML is an extremely mediocre design: it is substantially worse than prior art in countless respects and tremendously complicated without achieving much of anything.
- jerome-jh 6y agoIndeed. Although XML has a grammar its complexity led to countless flawed implementations. The original sin of XML is that it has been over-hyped from the beginning. Is it the cause or the consequence of it being over-engineered, I would not say. Anyway following standards, XLST, XPath, saw poor adoption. I am not fond of JSON and YAML either, but since they are much less ambitious, I am somewhat more forgiving with them. None of them is good at being a config file format. None one them is good at data serialization, that should be binary and TLV encoded.
- WesolyKubeczek 6y ago> it is substantially worse than prior art in countless respects The prior art being? ASN.1 libraries don't have a stellar security track record either. Flexible data interchange is _hard_.
- patrec 6y agoXML is basically just a vastly inferior form of sexps, just as ASN.1 at least for the purposes of encoding cert info in TLS is vastly inferior to csexps -- the latter is canonical by design, efficient and trivial to write a robust parser for.
- acdha 6y agoIf this is so trivial, why has it not been done? It seems unlikely that nobody has ever heard of a common term.
- patrec 6y agoUhm, it has been done. Writing an obviously correct csexp serializer is literally 3 lines of code in a high level language and writing a deserializer is only slightly more LOCs (and yeah, I've used it in production for real stuff). If your model of the world is that because you don't know something it can't be vastly better than the stuff you know and that is widely used, you should consider refining that model. It's not how things work; sometimes fields take a wrong turn that is difficult to recover from or get swamped by morons who drive the good people out. A lot of what we have in 2020 would strike a smart practioner from half a century ago as shockingly braindead and outmoded and a lot would seem like scifi. XML is not a member of the scifi category.
- sergeykish 6y agoI had whitespace removed by XSLT moment. Why would a format designed for application consumption have insignificant whitespace? Also HTML whitespace handling makes all sort of bugs in contenteditable. Chrome inserts instead of space, finally found solution * { white-space: pre-wrap } Still it removes first newline in <pre>, at least that is solved in XHTML. I would love to see how XSLT can be implemented on s-expressions. Attributes are not required.