Skip to Content.
Sympa Menu

xom-interest - Re: [XOM-interest] XOM-interest Digest, Vol 47, Issue 5

xom-interest AT lists.ibiblio.org

Subject: XOM API for Processing XML with Java

List archive

Chronological Thread  
  • From: "Michael Kay" <mike AT saxonica.com>
  • To: "'Wolfgang Hoschek'" <wolfgang.hoschek AT mac.com>, "'Elliotte Harold'" <elharo AT metalab.unc.edu>
  • Cc: 'Jeff Williams' <jeff.williams AT aspectsecurity.com>, xom-interest AT lists.ibiblio.org
  • Subject: Re: [XOM-interest] XOM-interest Digest, Vol 47, Issue 5
  • Date: Tue, 12 Dec 2006 09:56:05 -0000

> That's a claim with some adhoc reasoning behind it, but not
> anywhere near a proof. Indeed, I'd be surprised if a credible
> proof emerged.

<snip/>

> Look, I'm not avdocating scare mongering, but I'd like to
> point out that approaching security with a mindset that tries
> to establish absolute certainty, proof, and the like, is at
> best a fragile fantasy and at worst a source of (costly)
> later security problems.

OK. So ad-hoc reasoning will have to do. Ad-hoc reasoning tells me that
there is no difference between CDATA sections and ordinary text nodes.

Security loses credibility if it stops us doing useful things, unless it can
come up with a clear explanation of why. When sending stuff to some of my
customers, I have to rename the .zip file as .zap to get it past security.
That's security making a complete fool of itself. This one seems very
similar.

Michael Kay
http://www.saxonica.com/






Archive powered by MHonArc 2.6.24.

Top of Page