On Oct 2, 2006, at 4:33 PM, Duncan Cragg wrote:

> Clearly there's a difference between a header declaring the type of
> stuff being transferred and the schema of that stuff, but once
> you've got up to XML, surely it's safe to transfer over from
> Content-Type to (explicit or implicit) schema?

No. What is the content difference between an archived invoice and
an invoice that I expect you to pay right now? There shouldn't be any.
The difference should be expressed in the action (method) and the
metadata (media type), not by changing the content. That is only
possible
in a system that alters the media type based on the reason the
content is
being viewed (i.e., the resource), which in turn is only possible if
we don't rely on a single meaningless media type for message exchanges.

> What problems does it cause with intermediaries to only specify the
> low-level types (say, charset and the fact that it's XML)?

Intermediaries cannot find the schema inside an XML body fast enough
to keep up with Internet-scale systems, and even if they could that
is not sufficient information to tell the system how the sender intended
the message to be interpreted. The media type tells the recipient how
the sender expects it to be processed, not just what the format is.

> Indeed, what problems does it cause with a consumer of the XML,
> assuming they can spot the schema on the first line and/or figure
> out what they've got by a little scanning around the elements?

Because if one component believes that "text/xml" messages are safe
and another component believes that "text/xml" messages should be
treated like a dynamic invocation interface, then the only way to
prevent a security hole is to block all XML content. We have to all
agree that "text/xml" will be processed in a specific, safe manner,
and some dangerous stuff can be related to "application/flash+xml"
and other specific media types.

That way we can make a conscious decision to block dangerous content
only when it is used in a dangerous way. (Some people will block all
dangerous content anyway, but that is a separate issue.)

....Roy