Hacker News Reader

Note that XML is not the problem. The very same problems exist with json also. There is still no clarification on duplicate keys, key ordering, and similar unspec'd oversights.

Signing the normalized content is of course a nightmare, given that there is no spec'd normalization.

View on HN

No, this is an XML-specific problem. JWT is bad, but it's not "you can create arbitrary forests of signed and unsigned trees" bad. XML sort of begs you to do that. JSON doesn't even support comments.

Though there are attempts underway to do inline signing of JWT (https://datatracker.ietf.org/doc/draft-jordan-jws-ct/), though that's still not nearly as bad as XML-DSIG of course. I'm sure some vulns will shake out of it.

Reply on news.ycombinator.com