Re: [BXXPwg] application/beep+xml

Marshall Rose <mrose@dbc.mtview.ca.us> Tue, 24 October 2000 17:10 UTC

Received: by ns.secondary.com (8.9.3/8.9.3) id KAA08105 for ietf-xml-mime-bks; Tue, 24 Oct 2000 10:10:55 -0700 (PDT)
Received: from dbc.mtview.ca.us (ppp-63-207-83-130.ded.pacbell.net [63.207.83.130]) by ns.secondary.com (8.9.3/8.9.3) with ESMTP id KAA08101 for <ietf-xml-mime@imc.org>; Tue, 24 Oct 2000 10:10:52 -0700 (PDT)
Received: (from mrose@localhost) by dbc.mtview.ca.us (8.11.0+3.3W/8.11.0) id e9OHDBv08525; Tue, 24 Oct 2000 10:13:11 -0700 (PDT)
Date: Tue, 24 Oct 2000 10:13:11 -0700
From: Marshall Rose <mrose@dbc.mtview.ca.us>
To: Dan Kohn <dan@dankohn.com>
Cc: bxxpwg@invisibleworlds.com, ietf-xml-mime@imc.org, mrose@dbc.mtview.ca.us
Subject: Re: [BXXPwg] application/beep+xml
Message-ID: <20001024101311.A8509@dbc.mtview.ca.us>
References: <25D0C66E6D25D311B2AC0008C7913EE00105A154@tdmail2.teledesic.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Disposition: inline
User-Agent: Mutt/1.2.5i
In-Reply-To: <25D0C66E6D25D311B2AC0008C7913EE00105A154@tdmail2.teledesic.com>; from dan@dankohn.com on Tue, Oct 24, 2000 at 09:58:54AM -0700
Sender: owner-ietf-xml-mime@mail.imc.org
Precedence: bulk
List-Archive: <http://www.imc.org/ietf-xml-mime/mail-archive/>
List-ID: <ietf-xml-mime.imc.org>
List-Unsubscribe: <mailto:ietf-xml-mime-request@imc.org?body=unsubscribe>

> Marshall, my only question is whether some of the Security Considerations of
> <http://www.imc.org/draft-murata-xml> additionally apply.  Since you are
> prohibiting the use of external entities, you avoid most of the risks,
> however there is still the possibility of someone parsing the data with a
> standard XML processor.  Also, you might explicitly want to mention whether
> this type follows RFC 2376bis's advice on use of the BOM (section 4),
> XPointer syntax (section 5), and Base URI (section 6).  Or, you could just
> leave these things undefined. 

hi. i think you're missing the point. the particular subset listed there
excludes all of the things you are mentioning. they aren't in the 1.0
specification. hence the addition text you request is redundant. that's
sort of the whole point.
    
/mtr