3 ms·
How can there be security issues with a public document? Can't you just sign it with a cert like any other piece of data that needs a proven source? But also l
by moffkalast 11mo ago
How can there be security issues with a public document? Can't you just sign it with a cert like any other piece of data that needs a proven source?
But also let me get this straight, there is an actual EU standard for invoices? Why the does nobody follow this and I have to keep asking people to put the fucking VAT ID onto it like I'm a broken record?
- rullera 11mo agoStates have not starting to enforce them until recently. As I understand it the goal is to have all members using them in a couple of years time
- daliusd 11mo agoActually, it's not universal and depends if it is B2G, B2B or B2C. The last one (B2C) is not enforced basically in EU (except Romania, but there is no EU requirement for B2C).
- IncreasePosts 11mo agoBecause when some things parse the document they do things like read files from the OS as specified in the document
- Analemma_ 11mo agoThe concern is that a malicious vendor could send you an evil invoice where the XML either references external entities that get downloaded and allow potential RCE, or where the document contains references to the local execution environment which allow data exfiltration (or both). In theory a properly-secured XML parser shouldn't allow this, but history has shown that's harder than you might think.