3 ms·

To be fair, XML wasn't intended as a data exchange format but as simplified SGML subset for use as delivery format on the web. While that largely hasn't happene

To be fair, XML wasn't intended as a data exchange format but as simplified SGML subset for use as delivery format on the web. While that largely hasn't happened, XML with XSD (sans rarely used feats) remains a strong exchange format for coarsely-grained inter-party traffic such as payment systems, taxes and other public/private data, etc. I'm guessing the security deficits you mention are XML entity attacks. Well, SGML has CAPACITY ENTLVL in the SGML declaration to limit expansion depth. And a markup authoring or delivery format without entities/text macros is quite useless, even though HTML, when seen as a stand-alone markup language rather than SGML vocabulary, lacks it.

goodpoint 5y ago
> XML wasn't intended as a data exchange format but as simplified SGML subset for use as delivery format on the web You cannot deliver web content without... exchanging data. And you cannot trust servers not to attack browsers.
- HWR_14 5y ago
  > And you cannot trust servers not to attack browsers. Interesting. I normally see it expressed the other way (trusting the server and not the client). Obviously, both are important.
  - mcv 5y ago
    I guess trust needs to be a two-way street. Even between computers.
    - HWR_14 5y ago
      Or lack-of-trust. Sanitize your inputs, because the other side is always an evil actor.
  - josefx 5y ago
    There was a time when every browser hack made headlines, now it has to involve something big like specter to get even noticed. Browsers and browser based applications still feature heavily at Pwn2Own style competitions, but YOLO lets add more pointless features with bug ridden APIs with every browser update.
    - HWR_14 5y ago
      This is true and I remember when they were big headlines. I guess since I'm not in browser development, I'm used to the idea of contacting a known good server from my code, but my known good server being accessible from anyone on the internet. Both are important, it's just interesting to see it written only from the other point of view.
      - tannhaeuser 5y ago
        Not wanting to disturb your browser sec discussion, but tbh I don't know what that has to with my GP post. If anything, SGML/XML allows hard validation of document data like basically no other mainstream tech.

goodpoint 5y ago

> XML wasn't intended as a data exchange format but as simplified SGML subset for use as delivery format on the web You cannot deliver web content without... exchanging data. And you cannot trust servers not to attack browsers.

HWR_14 5y ago
> And you cannot trust servers not to attack browsers. Interesting. I normally see it expressed the other way (trusting the server and not the client). Obviously, both are important.
- mcv 5y ago
  I guess trust needs to be a two-way street. Even between computers.
  - HWR_14 5y ago
    Or lack-of-trust. Sanitize your inputs, because the other side is always an evil actor.
- josefx 5y ago
  There was a time when every browser hack made headlines, now it has to involve something big like specter to get even noticed. Browsers and browser based applications still feature heavily at Pwn2Own style competitions, but YOLO lets add more pointless features with bug ridden APIs with every browser update.
  - HWR_14 5y ago
    This is true and I remember when they were big headlines. I guess since I'm not in browser development, I'm used to the idea of contacting a known good server from my code, but my known good server being accessible from anyone on the internet. Both are important, it's just interesting to see it written only from the other point of view.
    - tannhaeuser 5y ago
      Not wanting to disturb your browser sec discussion, but tbh I don't know what that has to with my GP post. If anything, SGML/XML allows hard validation of document data like basically no other mainstream tech.