Re: [arch-d] deprecating Postel's principle- considered harmful

[Phillip Hallam-Baker <[e-mail]>]

Let's talk about how Disney Studios lost their way. They tried to continue
the methods of the great man after he died and it was a disaster. Then they
suddenly realized that the great man himself had never done things the way
they thought he did. Walt Disney did use storyboards, they were in his head
all the time. So now they use storyboards and if you invested in Disney
back in 2000 you are a very happy camper right now.

We get the end-to-end principle wrapped around the axle in the same way.
The argument is much more subtle than most imagine. The real principle
being *think* very carefully about where you put complexity.

The problems with the robustness principle became clear when we started to
try to extend HTML and found that it was almost impossible to do it right
because every implementation in the wild handled unknown input in different
ways.

The issues with SMTP are not the same because we have never really tried to
change SMTP in drastic ways and even the incremental extensions are all
working around the mass of legacy deployment.

My approach is to distinguish reference code from running code and reverse
the robustness principle. Reference code should be pedantic in what it
accepts and liberal in what it generates. In fact it should perform fuzzing
on its outputs deliberately sending maliciously formed messages to test for
security vulnerabilities.

We live in a different Internet today. There are well funded nation state
actors working to break it. That is their job. There is a full blown
cyber-war going on out there.

The other point I think relevant is that there are limits to re-use of
existing code or infrastructure. There comes a time when starting from
scratch is not just the best approach, it is the only viable approach.
Accepting the robustness principle means this point will be reached sooner.