W3C home > Mailing lists > Public > www-svg@w3.org > November 2004

Re: SVG 1.2 Comment: B.2.3 Socket Connections

From: Boris Zbarsky <bzbarsky@MIT.EDU>
Date: Wed, 03 Nov 2004 22:25:49 -0600
Message-ID: <4189AF4D.5060006@mit.edu>
To: Denis Bohm <denis@fireflydesign.com>
CC: www-svg@w3.org

Denis Bohm wrote:

>>The point is that once you've implemented this securely, it becomes less
>>useful than URLRequest, since it can only access HTTP ports, but doesn't
>>do HTTP. It seems bad to have a feature that is only useful if implemented
>>in insecure ways.
> 
> I don't understand what your point is.  It seems to be that since some sites
> will only allow HTTP requests that SVG should not implement a more powerful
> network interface for anyone?

Ian's point wasn't about sites but user-agents.  The point was that any 
user-agent that does want to be used as an attack vector (thus possibly opening 
its users up to legal action, as the attack will originate from THEIR computer) 
will have to restrict this interface to HTTP requests or otherwise severely 
limit its usefulness, to the point where it is no more useful than existing 
methods of making HTTP requests, and possibly less useful.

> The SVG socket interface is very useful as it allows two way asynchronous
> communication.

The problem is that it allows evil.com, say, to make it look like John Smith, 
who was just looking at the nice SVG image on evil.com, was sending spam through 
the mail servers run by randomisp.net...  Since the socket connection is made 
from John Smith's machine, he could be the one held responsible under the 
various anti-spam laws on the books.  How do you envision UAs implementing this 
functionality without causing problems like this for their users?

-Boris
Received on Thursday, 4 November 2004 04:25:54 UTC

This archive was generated by hypermail 2.3.1 : Wednesday, 5 February 2014 07:14:52 UTC