Linus Torvalds (torvalds@linux-foundation.org) on 1/29/09 wrote:
---------------------------
>slacker (s@lack.er) on 1/29/09 wrote:
>>
>>I explain how this is a problem with virtually any sort of
>>metadata, whether it's stuck in file headers, wrapped
>>in to folders, inserted in to a xattrs, or shoved in to a
>>database.
>
>I ignore your argument, because your argument boils down to
>
>

> "some data formats are already insecure, so we might

>as well make all data formats be so, and I'm not

>even listening to your 'external database' suggestion".

>

Poor summary. I submit two things:

1. Metadata fundamentally undermines privacy and security. When data is "associated" with a file (metadata), rather than being the file itself (data stream), users either forget to examine it, ignore it, or be completely unaware that it exists. Thus, diligence on the part of the user is necessary whenever metadata is used.

2. The existence of metadata should never be hidden from the user. As a corollary, it should be easy for a user to update/modify/erase metadata. In this fashion, Extended Attributes are "safer" than any other implementations of metadata (or, at least, as safe), because they can be wiped easily, and by using a single tool.

I applaud your efforts to ignore poor arguments. Unfortunately, you were ignoring a strawman instead of honestly evaluating my arguments.

>So let me repeat: using an external database has absolutely
>zero downsides compared to EAs:
>
> ....
>
>- Yes, it requires you to use a special DB interface, but
>hey, how much less convenient is that than using special
>EA interfaces, really?

It's MUCH LESS CONVENIENT. I recognize the advantages of using a database, including the two points that you mentioned, but you just handwave away any utility that xattrs offer by saying, "oh, this other way isn't so bad."

>- And if you really want to make sure that the
>extended attributes really always follows the data (which
>is a big "if" to begin with), embedding them in the data
>stream is still preferable to EA's, because of the
>portability issues.

This was the very problem that I wanted to avoid, and you've gone right back to it. If I embed the metadata inside the data stream, modifying the metadata modifies the file itself, and the checksum will change.

-----------------------------------------------------------

I think we are finished with our arguing. Instead, I will offer to the readers of this sub-thread an example of where I would use Extended Attributes:

Let's say that I have ripped all of my CDs to MP3 format, and I want to "tag" each song with metadata. The MP3 file format supports "ID3 tags" for this purpose. However, when you modify ID3 tags, you are modifying the MP3 itself, and the checksum will change. Instead, you can use Extended Attributes for this purpose

$# Let's get the checksum for the file: 

$ md5 "Sinatra - Witchcraft.mp3" 

MD5 (Sinatra - Witchcraft.mp3) = a5eb19fd03dd47dee4537e7e4d58313f



$# Now let's add metadata to the song using Extended Attributes:

$ ./xattr --set Artist "Frank Sinatra" "Sinatra - Witchcraft.mp3" 

$ ./xattr --set Year "1957"  "Sinatra - Witchcraft.mp3" 

$ ./xattr --set Composer "Cy Coleman" "Sinatra - Witchcraft.mp3" 

$ ./xattr --set Album "The Complete Capitol Singles Collection" "Sinatra - Witchcraft.mp3" 

$ ./xattr --set Genre "Debonair" "Sinatra - Witchcraft.mp3" 



$# Let's look at what was added::

$ ./xattr --list "Sinatra - Witchcraft.mp3" 

Sinatra - Witchcraft.mp3

           Album        The Complete Capitol Singles Collection

          Artist        Frank Sinatra

        Composer        Cy Coleman

           Genre        Debonair

            Year        1957



$# Calculate the checksum again: 

$ md5 "Sinatra - Witchcraft.mp3" 

MD5 (Sinatra - Witchcraft.mp3) = a5eb19fd03dd47dee4537e7e4d58313f



$# The checksum is the same! What if we update the xattrs?: 

$ ./xattr --set Genre "Male Vocal" "Sinatra - Witchcraft.mp3" 

$ ./xattr --list "Sinatra - Witchcraft.mp3" 



Sinatra - Witchcraft.mp3

           Album        The Complete Capitol Singles Collection

          Artist        Frank Sinatra

        Composer        Cy Coleman

           Genre        Male Vocal

            Year        1957



$ md5 "Sinatra - Witchcraft.mp3" 

MD5 (Sinatra - Witchcraft.mp3) = a5eb19fd03dd47dee4537e7e4d58313f



$# The checksum hasn't changed. We've associated metadata with a 

file without changing the file itself. What if we copy the file?: 



$ cp "Sinatra - Witchcraft.mp3" Send_to_Friend.mp3

$ ./xattr --list Send_to_Friend.mp3 



Send_to_Friend.mp3

           Album        The Complete Capitol Singles Collection

          Artist        Frank Sinatra

        Composer        Cy Coleman

           Genre        Male Vocal

            Year        1957



$# The extended attributes were copied over to the new file. What if 

we want to wipe all the metadata before sending the file to someone?: 



$ cp "Sinatra - Witchcraft.mp3" Send_to_Linus.mp3

$ ./xattrwipe.py Send_to_Linus.mp3

wiping xattrs.... COMPLETE



$ ./xattr --list Send_to_Linus.mp3 

Send_to_Linus.mp3



$ md5 Send_to_Linus.mp3 

MD5 (Send_to_Linus.mp3) = a5eb19fd03dd47dee4537e7e4d58313f



$# The metadata has been wiped clean, without any knowledge of the 

file's internal structure, and without using any proprietary tools.

The file's data stream has not been modified even once during this 

whole process, as verified by the unchanging MD5sums.