Fwd: Re: [ubl-ndrsc] xsd:documentation vs xsd:appinfo

["Stephen Green" <stephen_green@bristol-city.gov.uk>]

--- Begin Message ---

• From: Eduardo Gutentag <Eduardo.Gutentag@Sun.COM>
• To: UBL FPSC <ubl-fpsc@lists.oasis-open.org>
• Date: Tue, 26 Aug 2003 22:31:40 -0700

(I know this email will bounce from the FPSC and LCSC lists -- can
someone please forward it to them?)

Chee-Kai

It is true that you may have heard that the reason for keeping things
in "documentation" rather than in "appinfo" was that it's safer.
However, that's "safer" not from a security point of view, but
rather from an interoperability point of view. The reasoning is
that appinfo may not be implemented equally among all applications,
and in particular that some sites/organizations/businesses are
known to forbid applications that interpret "appinfo" precisely
as it's intended, that is as machine-readable (and executable) data,
indeed for security reasons. The agreement we reached in NDR not too
long ago was that while it is ok to put in appinfo non-normative
data, normative data should never be put in it because we'd run the
risk that it may never be processed.

I am sure that Mark and others may have more to say about this.

Chin Chee-Kai wrote:
> I think it is about time to start thinking seriously
> about moving data values out of existing xsd:documentation
> and into xsd:appinfo.
> 
> I understand during yesterday's LC call that FP's 
> code list team is looking into where to store their 
> metadata, and an outcome will "decide" to some extent
> where the values go.  But I also understand that FP's
> set of metadata relates to presentational metadata,
> whereas existing <ccts:Component> data values relate
> to modeling and object class metadata.   Both are
> metadata (and so are data instead of documentation),
> but used at different times in different areas.
> 
> It is a stated guide for UBL to follow recommendations
> and usage guidelines from W3C.  And XML Schema's
> xsd:appinfo is created precisely for the purpose of
> storing data that usually machines/apps would need,
> thus "appinfo".  Why are we choosing to be the odd one
> out by storing data into "documentation" instead?
> 
> I earlier heard some summarised points of arguments
> supporting the storage of data values in "documentation"
> for some security reasons.  I could have heard wrongly,
> but security was quoted as the reason, that storing
> data in "documentation" is "safer" than storing data
> in "appinfo".   I'd like to suggest that we don't lose 
> focus on the proper usage of the "appinfo" mechanism 
> over reasons that are not going to be solved by moving
> to "doucmentation" anyway.    
> 
> This is by no means to say that security is not an issue,
> but rather, a debate over security safety levels between
> "documentation" and "appinfo" is really an XML Schema 
> specification issue that is not going to reach any 
> resolution within UBL.  And as long as we say we should
> follow W3C recommendations, application info ought to
> go into "appinfo";  I didn't see any debate being even
> necessary here, but perhaps on how the structure of elements
> should look within "appinfo".
> 
> So, I'd like to hear if there's any further counter-remarks,
> or remarks on other perspectives that are in favor of
> data being stored in "documentation".  Please raise them
> soon.  I've made replies go to FPSC list since that's
> where the code list discussion on where presentational metadata
> should go is happening.
> 
> Thanks.
> 
> 
> 
> Best Regards,
> Chin Chee-Kai
> SoftML
> Tel: +65-6820-2979
> Fax: +65-6743-7875
> Email: cheekai@SoftML.Net
> http://SoftML.Net/
> 
> 
> 
> To unsubscribe from this list, go to http://www.oasis-open.org/apps/org/workgroup/ubl-ndrsc. Note:unsubscribing will result in your withdrawal from this OASIS Technical Committee.
> 

-- 
Eduardo Gutentag               |         e-mail: eduardo.gutentag@Sun.COM
Web Technologies and Standards |         Phone:  +1 510 550 4616 x31442
Sun Microsystems Inc.          |
W3C AC Rep / OASIS BoD


To unsubscribe from this list, go to http://www.oasis-open.org/apps/org/workgroup/ubl-ndrsc. Note:unsubscribing will result in your withdrawal from this OASIS Technical Committee.

--- End Message ---