Subject: [Rfc-markdown] Kramdown-rfc 1.0.38 embeds markdown source in XML

From: Carsten Bormann <[email-masked]>
Date: Mon, 31 Oct 2016 16:40:46 +0100

A little heads-up:

On the tools-development list, there was a discussion if there can’t be a way to upload the markdown source together with the compiled XML and TXT.  Well, that is maybe not happening soon.  But then the idea came up to maybe simply embed the source in the XML so it is always implicitly uploaded with the XML.

Kramdown-rfc version 1.0.38 now embeds the complete markdown source (after performing include statements) in the XML (RFC 1952 gzipped*) and base64-encoded).
(This can be suppressed by setting the environment variable KRAMDOWN_NO_SOURCE, e.g. if you have company secrets in your markdown or you just want a smaller XML.  Might also be good for Travis and friends.)

Once you have an XML generated by kramdown-rfc, use the new tool kramdown-rfc-extract-markdown for extraction:

	kramdown-rfc-extract-markdown foo.xml >foo-recovered.md

Grüße, Carsten

*) Security-minded people will notice that, besides all your company secrets in the kramdown comments, this also leaks a compilation timestamp.

---

From: "Paul Hoffman" <[email-masked]>
Date: Mon, 31 Oct 2016 08:47:11 -0700

On 31 Oct 2016, at 8:40, Carsten Bormann wrote:

> A little heads-up:
>
> On the tools-development list, there was a discussion if there can’t 
> be a way to upload the markdown source together with the compiled XML 
> and TXT.  Well, that is maybe not happening soon.  But then the idea 
> came up to maybe simply embed the source in the XML so it is always 
> implicitly uploaded with the XML.
>
> Kramdown-rfc version 1.0.38 now embeds the complete markdown source 
> (after performing include statements) in the XML (RFC 1952 gzipped*) 
> and base64-encoded).
> (This can be suppressed by setting the environment variable 
> KRAMDOWN_NO_SOURCE, e.g. if you have company secrets in your markdown 
> or you just want a smaller XML.  Might also be good for Travis and 
> friends.)

This is a terrible default for a new feature. Many people put notes of 
what they want to do next in the comments in the Markdown source. Some 
of these comments can include opinions on WG comments. I think many 
people will be surprised to see those in the XML, particularly if they 
were already uploading the XML automatically.

> Once you have an XML generated by kramdown-rfc, use the new tool 
> kramdown-rfc-extract-markdown for extraction:
>
> *) Security-minded people will notice that, besides all your company 
> secrets in the kramdown comments, this also leaks a compilation 
> timestamp.

Snark aside, there is a difference between secrets and "things that I 
would rather be kept private".

---

From: Carsten Bormann <[email-masked]>
Date: Mon, 31 Oct 2016 17:08:48 +0100

On 31 October 2016 at 16:47:31, Paul Hoffman ([email-masked]) wrote:

Hi Paul,

yes, of course I thought about that too, and that’s also why I considered it prudent to give this heads-up.

Right now true markdown comments are handed through as XML comments, so — surprise — they already haven’t been private if you upload the XML!
I have got more than one question from the RFC editor when I forgot to delete one of those comments :-).
(If you need more privacy, just upload the .txt.)

Only if you actually are using the obscure kramdown comments (the ones starting with “{::comment}”), or the kramdown-rfc “fluff” feature, does the new feature leak information.
I could spend some time implementing getting rid of either, but unfortunately not today.

Since I have been part of several efforts already to reconstruct the markdown from an XML file when the author just vanished, I consider the default of embedding the source highly desirable, and I believe that justifies the somewhat abrupt introduction.

Grüße, Carsten

---

From: "Paul Hoffman" <[email-masked]>
Date: Mon, 31 Oct 2016 09:32:51 -0700

On 31 Oct 2016, at 9:08, Carsten Bormann wrote:

> Since I have been part of several efforts already to reconstruct the 
> markdown from an XML file when the author just vanished, I consider 
> the default of embedding the source highly desirable, and I believe 
> that justifies the somewhat abrupt introduction.

Hrm. I hadn't thought of that and, yes, that's probably a very valid use 
case for maintaining the comments.

--Paul Hoffman