2

MathML seems like a promising and attractive technology. But Google Chrome doesn't support it, allegedly because it has "architectural security issues" according this wikipedia page. But it also says "low usage do not justify their engineering time". It seems that Firefox and Safari have been supporting it just fine for quite a while. I am considering trying out MathML instead of MathJax in my business and I am concerned whether there is any substance in those "security issues" claimed by Google. How would a markup language be a security issue anyway?

4

The architectural issues you mentioned seem to have been resolved, according to this comment:

The MathML code had fundamental architectural issues (e.g. modifying the render tree during layout) that are guaranteed to introduce security vulnerabilities. Until those underlying issues were fixed, our fuzzing infrastructure was just going to continue identifying new triggers for the vulnerabilities.

Despite this fact, adding new and highly complex code with unclear ownership (i.e. who should be maintaining it) is a recipe for security vulnerabilities. Any time you add complex features to a browser render engine, you risk introducing severe security bugs. It seemed that Google tried adding it and found that the risk of new bugs was just too high and removing them all was just too difficult for them to go forward. Unless someone can provide high-quality code and is willing to maintain it completely, it is unlikely that Google Chrome will be getting native MathML support.

See the relevant threads at the Google bug tracker:

  • So, the issues were not with MathML at all, but rather with the MathML implementation in Chrome, if I read that correctly. (Ignoring indirect effects such as maybe the complexity of MathML leading to complexity in the implementation, making it harder to secure.) – Jörg W Mittag Jan 19 at 21:44
  • @JörgWMittag That's correct. MathML itself is nothing but a markup language. – forest Jan 21 at 2:00

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.