I would also like to raise the question as to why, if SMIL elements are
to be namespaced within XHTML, SMIL attributes on XHTML elements are
also not to be namespaced (e.g,. the Timing attributes on <body/>)? It
would seem to me that a namespace should be restricted to the elements
and attributes defined for the original specification.
My thought is that original specifications should anticipate for
expansion by always explicitly allowing namespaced attributes or even
children (e.g., at least anticipate expansion of children into generic
containers like <div/> or <span/> or wherever they might be useful, such
as in the <head/>)), with expansion being performed with namespaces. I
think that besides allowing for third-party expansion, this approach
should make it easier for applications to sanitize input, as they could
safely and conveniently whitelist an entire namespace (blacklisting only
the portions they didn't wish to allow) without fear of the namespace
being expanded in the future. Otherwise, applications concerned with
security are burdened with whitelisting all possible elements, rather
than being able to safely use a blacklist approach.
thank you,
Brett Zamir
