Subject: Re: text-only in atom:title?

From: "Michael Stillwell" <[email-masked]>
Date: Thu, 2 Sep 2004 08:29:00 +0100

On Sep 1, 2004, at 00:17, Antone Roundy wrote:

> On Tuesday, August 31, 2004, at 04:57  PM, Michael Stillwell wrote:
>> My variation on your "pink text" example was intended to show that  
>> the Atom spec will need to specify what parts of XHTML+CSS are  
>> supported in atom:content.  That is, the "slippery slope" discussion  
>> cannot be avoided because the spec will need to specify a point on  
>> this slope for atom:content.
> Do we have/want to specify this?  We certainly need to mention
> something in the "Security Considerations" section about the potential 
>  for abuses via HTML, scripting, CSS, etc., and I'm sure articles will 
>  be written to help people figure out how to avoid the potential  
> problems.  But I wouldn't think we'd want to go so far as to proscribe 
>  the use of any particular parts of those technologies, especially  
> since doing so could cause more harm than good if it gives people a  
> false sense of security.  "The spec says not to include JavaScript, so 
>  I don't need to write code to strip out JavaScript."

If there's a security issue with your aggregator, you should do 
something about that irrespective of whether or not the feed you 
received is valid.  (Just as with web browsers.)

Atom will survive without an explicit statement of what markup is 
supported (as RSS has) but I think such a statement (or an accompanying 
document) would make it more useful and complete.  This would give 
aggregator authors something to aim for and also some way for them to 
describe their level of support.  e.g. "FooBar supports Atom HTML, with 
the exception of X."  Similarly, it gives feed authoring tools some 
idea as to what's likely to be understood.  (Is <h2> supported?  If not 
they might translate "<h2>something</h2>" into 
"<p><b>something</b></p>".)

Knowing what to expect in atom:content is also helpful to those who 
embed entries into HTML, especially if they're trying to create valid 
HTML.  One thing that bugs me about the current RSS specifications is 
that completely valid feeds can contain invalid HTML: HTML-producing 
aggregators need to be able to tidy HTML just to support the spec.  
(Aggregators will in practice support broken feeds, but it doesn't seem 
right for the spec to effectively require this functionality.)

--M.

-- 
http://beebo.org
+44 78 21 18 90 49