Re: Security: Atom injection attacks

[James M Snell <jasnell@xxxxxxxxx>]

It puts the burden on applications of APP to communicate what is
required.  APP itself is a very generic protocol.  Thus far in just the
range of stuff we're doing, we've seen uses of it for editing weblogs,
managing calendars, discussion forums, wikis, document libraries,
podcasts, bookmark collections, contacts, xml document repositories,
collection management, user management, etc.  The only thing that has
remained constant across all of the various types of applications is
that every application tends to make different assumptions about what is
required and what is not; about what of the many options the Atom syntax
allows will be supported and which ones will not.  I gave up a long time
ago trying to make the APP spec prescriptive for all the various ways it
could be used.  For now, we need to allow specific implementations
define their own specific behaviors and requirements and allow clients
to adapt to those as necessary.  In the future, if best practices
emerge, the folks who care the most can get together and put together a
BCP for APP.  Until then, let's do the minimum we need to get functional
implementations out there and then get out of the way.

- James

Elliotte Harold wrote:
> [snip]
> This seems to be the attitude of the spec. Given how little people are
> willing to promise about server behavior, I don't see how a generic
> client can assume very much at all.
>