News for hackers. Stuff that matters.
Re:XML Appliance by eadmund on Friday March 31, 2023 @05:52AM (#35384687)
> I Love XML. Well-designed XML is better than well-designed JSON IMHO for human readability.

But both are absolutely inferior to S-expressions. Compare this (from https://www.xml.com/pub/a/2004/07/21/design.html):

    <books xmlns='http://www.example.com/books'>
    
      <book publisher="Addison Wesley">
    
        <title>Mythical Man Month</title>
    
        <author>Frederick Brooks</author>
    
        <publication-date>1995-06-30</publication-date>
    
      </book>
    
      <book publisher="Apress">
    
        <title>Programmer’s Introduction to C#</title>
    
        <author>Eric Gunnerson</author>
    
     <publication-date>2001-06-30</publication-date>
    
      </book>   
    
    </books>
to this:

    (books (ns "http://www.example.com/books")
           (book (publisher "Addison Wesley")
                 (title "Mythical Man Month")
                 (publication-date "1995-06-30"))
           (book (publisher "Apress")
                 (title "Programmer’s Introduction to C#")
                 (author "Eric Gunnerson")
                 (publication-date "2001-06-30")))
The S-expression is trivially parseable; the XML, OTOH, requires a fairly complex (hence potentially buggy and insecure) piece of software — and if you’re not careful, you’re susceptible to a billion-laughs attack. The XML will be littered with extraneous text elements between the tags; the S-expression is not. The S-expression just has atoms and lists; the XML has both tags and attributes. Why is publisher an attribute while title is a tag? Who knows?

It’s probably not a coincidence that a Google search for "well-designed XML" yields very few results, with your comment one of those few.

Re:XML Appliance by lenkite on Friday March 31, 2023 @07:29AM (#35385433)
Sorry not a good example by deliberately bloating the XML and also adding double-line spacing. title, author and publication-date should be XML attributes as they don't have children and are singular data of a singular data type.

    <books xmlns='http://www.example.com/books'>
      <book author="Frederick Brooks" 
          publication-date="1995-06-30"
          title="Mythical Man Month" />
      <book author="Eric Gunnerson" 
          publication-date="2001-06-30"
          title="Programmer’s Introduction to C#" />   
    </books>
Sweet, succinct and can be validated with an XSD and given auto-complete and tab placeholder support in your editor/IDE.

The above can be parsed without bugginess or insecurity - those feel like opinions to me. We manage to parse and render trillions of HTML markup following the same style without issues.

Re:XML Appliance by eadmund on Saturday April 01, 2023 @06:10AM (#35398971)
> Sorry not a good example

I just pulled the example from the article ‘Designing Extensible, Versionable XML Formats’ hosted at xml.com. Presumably xml.com has decent examples of XML?

I an pretty sure that author is not a singular data type, since it is possible for a book to have multiple authors.

> Sweet, succinct, elegant

I think it’s still inelegant in comparison to the S-expression version.

> The above can be parsed without bugginess or insecurity - those feel like opinions to me.

A quick Googling for ‘xml parsing cve’ shows plenty of hits. Are you familiar with billion-laughs exploits? XML is well-known for them: https://en.wikipedia.org/wiki/Billion_laughs_attack