- From: Bijan Parsia <bparsia@cs.manchester.ac.uk>
- Date: Fri, 20 Mar 2009 18:38:28 +0000
- To: W3C OWL Working Group <public-owl-wg@w3.org>
On 20 Mar 2009, at 15:34, Ivan Herman wrote: > Bijan Parsia wrote: >> >> From a security perspective, it seems that Jena puts up a warning at >> least the first time you use GRDDL, but it's unclear if it does it >> every >> time it downloads a new transform. I don't know if it caches, so the >> effect on W3C traffic is still unknown. I don't know anything momre >> about signing or checksumming the XSLT, so I think it still is a >> fairly >> large security risk. > > I am not sure it is a perfect answer but I put extra information > into my > FOAF file: [snip] > Can't we put something similar into the RDF file that refers to the > XSLT > transform? Ie, store the signed version of it side by side and refer > to > it through some vocabulary. I guess. Shouldn't we take the opportunity, however, to improve GRDDL practice? I mean, again, the pain of current implementations breaking on our GRDDL is superduperlooper low, afaict. And, arguably, they should be fixed. I would suggest that we set something up that denies non-cachers access, etc. and sign directly so that implementations check that. > I use PGP here, we can also use some form of XML Signature and store > that. > > It is not perfect. But if an implementation wants to check the > integrity > of the transformation, it can. Optional security isn't :) Cheers, Bijan.
Received on Friday, 20 March 2009 18:39:03 UTC