3 ms·
The vulnerabilities happened, we're aware of them now, and the major libraries (which you should be using anyway) will be sure to fix them. This isn't a compell
by jimmaswell 5y ago
The vulnerabilities happened, we're aware of them now, and the major libraries (which you should be using anyway) will be sure to fix them. This isn't a compelling case to throw away SAML, just to be mindful not to make certain implementation errors.
- eyelidlessness 5y agoI think this is missing a huge part of the point of the article: the complexity of the standard and the domain space it provides makes implementation errors more likely. It’s akin to saying “making a web browser is easy, just follow the spec”; but the spec is a sprawling set of standards, with many layers of revisions and many important details left up to implementations. In both cases, implementations may not be nearly as cautious about the finer points of the spec. That’s a huge weight for either to carry, and probably the only reason we haven’t seen a similar proliferation of browser implementations with horrific vulnerabilities is that the spec is so huge and the incentives to build a new one are so low.