Re: Fw: Signing of XSL scripts

[Gavin Nicol <gtn@xxxxxxxxxxxx>]

>It is beginning to look as if the use of ECMAScript may lead to some
>problems with system security unless there is a change in the way in which
>scripts can be authenticated in Internet Explorer. For input/output to a

Even authentication isn't enough. Having an arbitrary scripting language
opens you to denial of serive attacks, and other such things. All the 
signing does is allow you to know who *supposedly* sent you the script
(it will always be possibly to fake identification here too given enough
resources). What is needed is some way for the XSL processor to be able 
to "prove" correctness. 


 XSL-List info and archive:  http://www.mulberrytech.com/xsl/xsl-list