Re: [xml-dev] It is okay for things to break in the future!

["Liam R. E. Quin" <liam@fromoldbooks.org>]

On Sat, 2022-09-03 at 16:26 -0600, C. M. Sperberg-McQueen wrote:
> a data validation routine that expects a house number followed by a
> street name is going to be worse than useless.)

In the 1990s/2000s i had a friend whose telephone number in the UK was
"Prickwillow 23". You had to call the operator to get connected. But
good luck getting forms to accept it.

Around the same time i tried to book a flight on Continental Airlines;
their Web site said that my Canadian postal code was "not a valid zip
code" and "a postal code cannot contain an M". (yes, yes, they can).

I ended up calling Continental on their 8900 nuymber, spending maybe an
hour on the 'phone, and they managed to find an old-fashioned "swipe"
VISA machine and wrote my credit card number in on it by hand, because
they couldn't get the system to work either.

I wrote to their support, who said, "Make sure you're on the page for
Canada" and sent me a Microsoft Word file containing an embeddee
screenshot. I replied to say, "I _was_ on the Canada page, please
forward to next level support!"

A month or so later I got a response to say they'd fixed the problem -
but in the meantime of course, no-one in Canada could book tickets on
Continental Airlines' Web site.

There's a tradeoff between rejecting garbage input and accepting real
data. Cf. Little Bobby Tables. But the same inept programming that gave
us SQL injection vulnerabilities also gave us CDATA injection
vulnerabilities and forms that enforce bad constraints.

liam



-- 
Liam Quin, https://www.delightfulcomputing.com/
Available for XML/Document/Information Architecture/XSLT/
XSL/XQuery/Web/Text Processing/A11Y training, work & consulting.
Barefoot Web-slave, antique illustrations:  http://www.fromoldbooks.org