Postel Was Half Right
The rule that let everything on the internet talk to everything is the same rule that means nothing can ever be cleaned up.
In 1980 a quiet man named Jon Postel wrote a sentence into the specification for the protocol that now carries almost everything you have ever sent over a wire: be conservative in what you do, be liberal in what you accept from others. It built the world you are reading this on, and it is probably the most generous sentence anyone has ever put into a spec. It is also a trap. The trap took about thirty years to spring.
First, the rule deserves its due, because it earned it. The early internet was being stitched together by dozens of teams in dozens of labs, all working from the same slightly ambiguous spec, in different languages, and there was no way to test one machine against another before they actually met on the wire. So if every implementation had thrown out anything that was not letter-perfect, nothing would ever have connected to anything. Being liberal in what you accept was not laziness. It was just the only way you could bootstrap a working network out of imperfect specs that imperfect people had written. Postel knew his own spec was fallible. He knew it would be read differently by different people, who would then build slightly different things from the same words, and the rule was there precisely to keep all those slightly different implementations talking anyway. Forgiveness was the grease that let the whole thing turn over.
But forgiveness only runs one way, and that is the problem. Watch what happens. One machine sends something a bit malformed. The machine on the receiving end, being liberal, shrugs and does the sensible thing with it anyway. So now the first machine's bug works. Nobody who wrote it ever finds out it was a bug, because nothing fails. Then the next machine comes along, written years later by people who were never in the room, and it has to accept that same malformed thing too, or else it can't talk to all the slightly broken senders that are already out there. And so the tolerance has quietly gone from a kindness that somebody chose to a requirement nobody can get out of. It's a ratchet. It clicks in easily and it physically can't click back out, because every reverse turn breaks traffic coming from innocent people who did nothing wrong and who will blame you and not the standard. A quirk everyone tolerates isn't a quirk any more. It's the spec, except nobody wrote it down and nobody can ever take it back out.
The browsers are the cautionary tale here, and it got written at the size of a planet. HTML was supposed to be tidy. Closed tags, proper nesting, attributes with their quotes round them. But browsers competed on one thing more than anything else, which was never showing the user an ugly error, so each of them quietly guessed at broken pages and rendered something regardless. And authors wrote pages that worked, which really just meant the pages looked right in whatever browser the author happened to have open at the time. So now every other browser had to go and reverse-engineer every rival's guesses and render the same broken soup the same broken way, or lose the users, who blamed the browser rather than the page. The garbage was now the contract. And here is the part that tells you the whole story. When the people writing the modern standard finally turned round and faced this, they didn't ban broken HTML. They couldn't. There was far too much of it and it was holding up far too much of the web. So instead they sat down and wrote out a precise, step-by-step algorithm for exactly how every browser has to parse broken HTML, so that at the very least they'd all be broken in the same way as each other. A spec for how to be wrong correctly. That's what giving up to liberal acceptance looks like once you finally carve it into stone.
There's a second cost as well, and the man who found it had spent his whole career paying it. Eric Allman wrote sendmail, which moved most of the world's email for years, so what that really meant was decades of being liberal in what he accepted from the entire internet. In 2011 he went back and reconsidered the rule. His verdict wasn't that Postel had been wrong, but that Postel had been writing for a room that didn't exist any more. Be liberal in what you accept means, if you read it plainly, accept malformed input from anyone at all, and that is the opening line of nearly every attack ever written. A parser that's generous enough to fix your honest mistakes is generous enough to misread an attacker's deliberate ones. Postel's network was a handful of trusting research labs who all knew each other. The network his rule outlived is full of strangers, and some of them are trying to get in. Without a single word of it changing, liberal acceptance ages from a courtesy into an attack surface.
The fix isn't really about kindness at all. It's about moving the strictness out to the edge and making it loud. Reject the malformed thing right at the boundary, early, while you're still building and the sender can still be told about it and can fix it, when rejecting it costs nothing, instead of swallowing it and finding out about the divergence years later when it's holding up production. A strict implementation while you're testing is how you find the bug in the first place. A liberal one just hides it until it's permanent. And make the thing you do accept a contract that can change on purpose, a version you can revise, rather than a default that silently keeps widening and can never be narrowed back down. The cleanest way anyone has worked out to keep the good half of Postel without the rot is this: let the people who depend on you tell you exactly what they need, in writing, as a test that breaks loudly the moment you let them down. Then you know exactly what you owe. You can tighten up everything you owe to nobody, and you can change things safely, because the contract will scream before any real person ever notices. Be liberal in what you accept turns into be exact about what you accept, and let the people who rely on you define what that is.
So Postel got one half right for ever, and lent us the other half at a rate we're still paying off. Be conservative in what you send is eternal, and it costs you nothing except discipline. Be liberal in what you accept was a loan, and the interest on it is that nothing can ever be cleaned up again.
In the manifesto, this is tenets (XV) and (IV).
Sources
- [Allman 2011] Eric Allman, "The Robustness Principle Reconsidered". ACM Queue 9(6), 2011. https://queue.acm.org/detail.cfm?id=1999945. The security and maintainability critique: a more hostile world turns liberal acceptance into attack surface; tenets IV, XV.
- [Postel 1980] Jon Postel (ed.), "DoD Standard Transmission Control Protocol", RFC 761 (Robustness Principle, §2.10). January 1980. https://www.rfc-editor.org/rfc/rfc761. "Be conservative in what you do, be liberal in what you accept from others"; the rule the post both credits and indicts; tenets XV, IV.
- [Robinson 2006] Ian Robinson, "Consumer-Driven Contracts: A Service Evolution Pattern". martinfowler.com, 2006. https://martinfowler.com/articles/consumerDrivenContracts.html. Let dependants state what they need as tests that break loudly, so acceptance is an explicit, revisable contract rather than a default that silently widens; tenet XV.
- [Thomson & Schinazi 2023] Martin Thomson & David Schinazi, "Maintaining Robust Protocols", RFC 9413 (IAB). 2023. https://www.rfc-editor.org/rfc/rfc9413. Active maintenance: evolve the contract on purpose to reduce ambiguity over time instead of relying on open-ended tolerance; tenet XV.
- [WHATWG 2014] WHATWG, "HTML Standard" (§13.2 Parsing HTML documents). 2014/ongoing. https://html.spec.whatwg.org/multipage/parsing.html. The deterministic algorithm that standardises how every browser must parse malformed 'tag soup' rather than banning it; tenet XV.
One of a series of field notes on building software for the way minds actually work: tired, distractible, ordinary, and now partly machine. They all lead back to the manifesto behind them, The Shape of the System.