‹ BackHN Continuity

Thread

SAML: A fractal of bad design

353 points · 190 comments · aray07

  1. HelloNurse · · focus · HN ↗
    "... it’s not the committee’s fault. XML is what they had at the time, and it’s what people used. JSON was “discovered” in 2001 ..."

    The committee had, at the very least, ASN.1. Not text, but any digital signature scheme has to be machine readable, not human readable.

    1. pseudohadamard · · focus · HN ↗
      More generally, if you're creating anything involving security, avoid XML like the plague because mixing the control and data planes, which in turn contain executable content/instructions and data, together in a random jumble is the gift to hackers that just keeps on giving.
Open on Hacker News to reply ↗

Unofficial Hacker News client; not affiliated with Y Combinator.