- From: Dan Connolly <connolly@w3.org>
- Date: Mon, 31 Jan 2000 22:28:49 -0600
- To: "Donald E. Eastlake 3rd" <dee3@torque.pothole.com>
- CC: IETF/W3C XML-DSig WG <w3c-ietf-xmldsig@w3.org>, "C. M. Sperberg-McQueen" <cmsmcq@acm.org>, "Henry S. Thompson" <ht@cogsci.ed.ac.uk>, Tim Berners-Lee <timbl@w3.org>
"Donald E. Eastlake 3rd" wrote: > > I've been thining about this some more and believe we should just go > with what all normal people think of as a URI. [and there was much rejoicing!] [...] > I don't see the non-validating parser / absence of a DTD as that much > of a problem as signature aware applications should, in effect, have > the XMLDSIG DTD built in and so can recognize our IDs in our elemnts, > including the Object elment, for example, which can be used to wrap an > optionally encoded data item anywhere in the document which contains > the Signature element, if the application is designed that way. Er.. you mean: <!DOCTYPE Signature SYSTEM "http://www.w3.org/2000/...signature.dtd"> <Signature> ... <Object> 23lk4j23j423... base64/quoted-printable/&#nnn; encoded stuff ... oiu234oi2u34o23 </Object> </Signature> ? Surely you're not going to prevent the straightfoward idiom where DSIG markup and application markup are nested ala: <Signature xmlns="http://www.w3.org/...signature"> ... <Object> <myTag xmlns="http://example.com/mystuff"> ...<myOtherThing label='xyz'/>..</myTag> </Object> </Signature> This is the case where it's infeasible to dereference IDREFs ... when you *didn't* write the DTD for myTag/myOtherThing. How is DSIG software going to know that the label attribute of the myOtherThing element has type ID? It has to read the DTD. And heck... it's a fairly hairy challenge just to come up with a DTD that combines the DSIG DTD with a DTD for myTag. But even in this case, it's straighfoward to write an #xptr(...) expression for "the element whose label attribute has value 'xyz'". > On the other hand, I don't give much weight to the argument against an > IDREF attribute because it is so limited compared with a URI when we > provide the URI attribute as an alternative. It's the usual argument for simplicity... the added code complexity isn't much in this case, but the added bloat in the spec that reviewers have to wade thru, extra test cases, tutorial material, ... adds up. -- Dan Connolly tel:+1-512-310-2971 http://www.w3.org/People/Connolly/
Received on Monday, 31 January 2000 23:32:02 UTC