Slashdot Mirror
W3C Recommends XML Signature Syntax
__past__ writes: "The W3C released a recommendation on XML Signature Syntax and Processing. The interesting point is not only that this is quite an important step for secure XML processing (esp. with regarding to web services), but also because there are some possibly ugly patent issues."
Yet another dull-as-dish recommendation from the W3C, not even a reference implementation to play with.
Ever since they have gone XML-with-everything they have produced ineffectual standards that are not followed by anybody as they are a pain in the ass to implement. It is no wonder that M$ and Sun prefer to create de facto standards instead of waiting for these guys to actually do anything. The killer app is the way to create standards and it's been a dozen years since we've seen one from the W3.
What I am nervous about is that with the advance towards the more sophisticated technologies, the earlier simpler technologies will be "obsoleted". This may have implications for the democracy of the web slowing going away because only experts can do what used to be an everyman task.
"It is a greater offense to steal men's labor, than their clothes"
>Ignore the problem and it goes away!
It surely wont go away. In fact, if you ignore the problem our federal govt will do what people that DO NOT ignore the problem suggest they do. The federal govt is currently debating this issue as we speak.
The US is already conforming to the rest of the world on patent matters (e.g., publishing applications after 18 months). so if you want your voices to be heard.. contact congress.
Here is a link on patent legislation in various countries and how the US interacts with them.
Click here!!!
A useful framework for some types of data it may be (specifically, markup data), but I feel that XML is too often used outside the scope of its main strengths. Specifically, object serialisation, transmission and other such protocols are handled more elegantly by ASN.1, Java serialisation (which can just as easily become a standard for other languages) or just rolling your own, program semantics by LISP syntax etc.
Far too often W3 encourage the blinkered approach that XML is the only way to express things. Stuffing base64-encoded strings into markup tags to be parsed at the other end is just not convenient and I think it can be done better.
Those who say that XML is simple are IMO not correct. XML can be veru complex, you cannot just make up new tags - they have semantic value in respect to a given target. This means that you have to have a target application that understands your XML, not much simplicity there. XML is not a language, it's a syntax. The syntax is easy, agreed, but implementations may have any complexity level.
XHTML is an XML schema. It's HTML that's valid XML, ie. it conforms to the XHTML DTD/Schema. For most it suffices that it's well-formed XML and as such can be parsed into a DOM tree by any XML parser.
Unable to read configuration file '/bigassraid/htdig//conf/14229.conf'
Geocrawler error message.
The web browser was the W3's (or, as it was, CERN's) big killer app. In the good old days they used to actually make things to prove that their standards would lead to useful technology. Do you really believe that the W3 should solely chair committee meetings and never get their hands dirty? Can good technology be designed in a vacuum? There is no seperate world of "standards bodies" here and "software houses" there - the most successful way to create a standard is to lead by example, and release a reference implementation. Presumably the W3 must have a prototype implementation somewhere; if they released it, more people might take their standards seriously. As it stands, a standard with no implementation can only be evaluated on by speculating about its theoretical merits - which is a risky strategy.
In the good old days, XML was simple but this is no longer the case as the W3C has created more and more complex standards that seem to require a P.hD to understand.
- Want to specify a structure for your XML? XML Schemas
- Want to query XML? XQuery
- Want to transform XML to some other format? XSLT
- Want to use XML as a transfer format for RPC calls? SOAP.
- Want to create links between XML documents? XPointer, XLink, and XML:Base are all needed.
- Want to include XML files in each other? XInclude
Many of the above standards are rather complex and difficult for most people to understand completely. This is besides the stuff one has to understand about XML infoset and XML namespaces to fully understand how to use XML properly.DISCLAIMER: The opinions in the above post are MINE ALONE and do not reflect the opinions, intentions or strategies of my employer.
It's even more scary for me. I live in Germany, where digital signature are treated almost equally to normal signatures in many areas (the laws are based on European legislation, so other European Union member countries should have similar laws). Digital signatures aren't widely used yet, but I think you'll agree that such laws have lots of potential uses.
I am, however, very worried about legally binding signatures being subject to patent issues. Signatures are commonly used to sign contracts of high legal importance, where at least one party wants to have written proof of the contract. Having digital signatures convered by patents will make free software implementations more difficult or even impossible, and the idea that signing a contract will be possible only in ways that the signees don't completely undestand and cannot fully control (because the implementation is proprietary) certainly doesn't sound like a good idea for a democracy.
Sig (appended to the end of comments I post, 54 chars)
The beauty of XML lies not just in its simplicity, but also its flexibility. Naturally people are using this flexibility to implement sophisticated applications -- and writing complicated descriptions of these applications. But none of these things makes XML itself more complex. You might as well say that RISC chips, such as PowerPC, stopped being simple when people started using them to emulate Pentiums!