On 9/12/2011 1:01 PM, Ron Wilson wrote:
In my own experience with my personal website, I have found that some service providers (not my web hosting provider, but ISPs between the web host and the browser), inject their own content into anything that looks like text regardless of the file extension or MIME type.
I've heard of [free] web hosts that would add advertisements to your content, and I've heard of filtering proxies that would add stuff to your content [to assure you that you're protected!], and I've heard of server worms that would add content to pages, and desktop viruses and browser extensions that would add to web content (to show you more ads or install other malware or other BS).
Some of these wouldn't plausibly affect a JSON web service, but I'll buy that some could.
HOWEVER, the mere fact that wrapping JSON in a bogus tag protected it from a horribly misbehaved system in the case Clark knows about is no guarantee that it would help in other cases. If you abandon the assumption that HTTP mostly works, on what basis could you possibly decide where to stop in defensively designing this? (Even HTTPS isn't enough--some people live with networks that by design man-in-the-middle all HTTPS connections.)
I would strongly oppose breaking compatibility with every JSON processor in the world (and, frankly, looking like idiots to people curious about fossil's web services) to possibly protect against some badly behaved proxies. A cool thing about open source is that people with batshit crazy environments can tweak a system so it works for them if they really can't fix their environment. I'm happy that open source can help people who live with crazy, but I don't want it to make me live with crazy.
-- Joshua Paine LetterBlock: Web Applications Built With Joy http://letterblock.com/ 301-576-1920 _______________________________________________ fossil-users mailing list [email protected] http://lists.fossil-scm.org:8080/cgi-bin/mailman/listinfo/fossil-users
