Kenton Varda wrote:
The output of your serializer will no longer be canonical. People won't be able to, say, used serialized messages as map keys or to compute hash values. That alone is probably enough reason not to do this.
Please correct me if I'm wrong, but isn't this *exactly* the UTF-8 security issue? My understanding is that the problem is that a single could have different byte representations, and in many cases people will only compare the byte representations to check for a match.
Of course, it is a difficult to imagine a case where someone would use a serialized protocol buffer in the same way, but it seems *possible*?
Evan -- Evan Jones http://evanjones.ca/ -- You received this message because you are subscribed to the Google Groups "Protocol Buffers" group. To post to this group, send email to [email protected]. To unsubscribe from this group, send email to [email protected]. For more options, visit this group at http://groups.google.com/group/protobuf?hl=en.
