Re: Proposed TAG Finding: Internet Media Type registration, consistency of use

> Anyhow, for the moment I stand by the position that sniffing is always 
> without exception bad when you're figuring out how to do top-level 
> dispatch.  It opens horrible security holes and when breakage does occur,
>  it focuses the blame away from where it belongs, namely people who screw 
> up in configuring their webservers.

I'd like to reinforce what Tim Bray said.  Ignoring the media type of
a document received via HTTP is a security hole.  Any browser that does so
has introduced a security hole in the organizations that use it.  Any
software company that distributes software purporting to implement HTTP
that deliberately violates the HTTP standard, like that described in

http://msdn.microsoft.com/workshop/networking/moniker/overview/appendix_a.
asp

is legally liable for any damages caused through exploit of that security
hole, since the developers are deliberately failing to adhere to well-known
and established best practice.  Negligence is not so easy to disclaim.

There exists a myth, long since debunked, that "users" desire a browser to
sniff the data content in order to compensate for apparently mislabeled
data.  In the entire history of the public HTTP standardization process,
no user has ever requested that as a feature (quite the opposite -- users
demanded that it MUST NOT be done).  As far as I am concerned, this myth
was started by a program manager with a bad case of feature-itis, and has
been promoted since then as an excuse without any evidence to back it up.
Users do not want this feature.

Cheers,

Roy T. Fielding, Chief Scientist, Day Software
                  2 Corporate Plaza, Suite 150
                  Newport Beach, CA 92660-7929   fax:+1.949.644.5064
                  (roy.fielding@day.com) <http://www.day.com/>

                  Chairman, The Apache Software Foundation
                  (fielding@apache.org)  <http://www.apache.org/>

Received on Tuesday, 4 June 2002 16:49:04 UTC