4 ms·
As a minor point of order, the exact phrase "parse, don't validate" has been conventional wisdom in langsec circles since I got involved, so 2014 at the earlies
by samatman 6y ago
As a minor point of order, the exact phrase "parse, don't validate" has been conventional wisdom in langsec circles since I got involved, so 2014 at the earliest.
I asked around on the work Matrix as to who actually coined it, but it's the weekend.
This is not to take anything away from @lexi_lambda, who cited her sources and documented an interesting type-theoretic approach to applying the principle. She did a great job!
If anyone wants to do a deeper dive, look into langsec, language-theoretic security. There's a lot of prior art to explore.
- matt-noonan 6y agoThe principle was certainly known, but I think Alexis really does deserve the credit for the catchy "parse, don't validate" wording. A Google search for that phrase, restricted to October 2019 and earlier, has no results (or rather, the results that do show up all are more recent additions such as comments, appended to previously-existing content)
- samatman 6y agoI assure you this isn't the case, I have personally heard it said as early as 2014. Meredith Patterson got back to me and attributes it to Sergey Bratus. We're a little vague on when, but it was quite some time ago. It's a great blog post, and it popularized the slogan, which is the important part. She was quite clear in the original post to cite langsec, everyone here is on a collegial basis. My point was not really about 'credit', it was about langsec. If the ideas in this library, and that post, are interesting, there's a lot more to discover in langsec. That's it.
- Iazel 6y agoCool, didn't know that, thanks for sharing!