3 ms·

I liked this summary: XML is almost always misused [1] The gist is that XML is best used for markup, because it inherits assumptions from the "document" metaph

I liked this summary: XML is almost always misused [1] The gist is that XML is best used for markup, because it inherits assumptions from the "document" metaphor that are not needed and are sometimes unhelpful for data interchange. An example of this is hashmaps & sets--they intentionally leave "order" or "sequence" out of their representation, but documents as a form of data interchange force you to keep thinking about it. [1] https://www.devever.net/~hl/xml https://www.devever.net/~hl/xml

wusspuss 5y ago
>XML is best used for markup, Funny enough, the one thing XMPP does not use xml for is markup! See https://xmpp.org/extensions/xep-0393.html https://xmpp.org/extensions/xep-0393.html - an ad hoc markup format https://xmpp.org/extensions/xep-0394.html https://xmpp.org/extensions/xep-0394.html - a laughably perverse usage of the already perverse XML format I don't know why they did this but I guess they had reasons - perhaps XML doesn't actually do that well even for markups
- Zash 5y ago
  Do not mention the format war. Once upon a time, we had XHTML-IM https://xmpp.org/extensions/xep-0071.html https://xmpp.org/extensions/xep-0071.html But then web developers came along and just put this directly into the DOM of their web clients, leading to endless XXS exploits, so XEP-0071 was burned at the stake. XEP-0393 might look ad-hoc, but it's essentially what people were typing into their chats and emails since time immemorial. People sometimes think this is Markdown and then pick a markdown library off the shelf and then the HTML passtrough bites them, leading us back to the beginning. I really don't understand how Matrix and Mastodon etc are allowed to pass around HTML embedded in JSON as if that somehow solves all those problems.
  - wusspuss 5y ago
    Tbh if a client is dumb enough to put xhtml-im directly into DOM with no verification that is the client's problem, not the XEP's, and that should be no reason to cancel it.
    - Zash 5y ago
      Well, if it was _a_ client. But if 100% of clients make the same mistake, then it is the spec that is the problem, or so the argument went. Maybe one day xhtml-im will make a glorious return as a 2.0, with bigger, better and scarier warnings about sanitizing your inputs

wusspuss 5y ago

>XML is best used for markup, Funny enough, the one thing XMPP does not use xml for is markup! See https://xmpp.org/extensions/xep-0393.html https://xmpp.org/extensions/xep-0393.html - an ad hoc markup format https://xmpp.org/extensions/xep-0394.html https://xmpp.org/extensions/xep-0394.html - a laughably perverse usage of the already perverse XML format I don't know why they did this but I guess they had reasons - perhaps XML doesn't actually do that well even for markups

Zash 5y ago
Do not mention the format war. Once upon a time, we had XHTML-IM https://xmpp.org/extensions/xep-0071.html https://xmpp.org/extensions/xep-0071.html But then web developers came along and just put this directly into the DOM of their web clients, leading to endless XXS exploits, so XEP-0071 was burned at the stake. XEP-0393 might look ad-hoc, but it's essentially what people were typing into their chats and emails since time immemorial. People sometimes think this is Markdown and then pick a markdown library off the shelf and then the HTML passtrough bites them, leading us back to the beginning. I really don't understand how Matrix and Mastodon etc are allowed to pass around HTML embedded in JSON as if that somehow solves all those problems.
- wusspuss 5y ago
  Tbh if a client is dumb enough to put xhtml-im directly into DOM with no verification that is the client's problem, not the XEP's, and that should be no reason to cancel it.
  - Zash 5y ago
    Well, if it was _a_ client. But if 100% of clients make the same mistake, then it is the spec that is the problem, or so the argument went. Maybe one day xhtml-im will make a glorious return as a 2.0, with bigger, better and scarier warnings about sanitizing your inputs