Re: Privileged and certified-level app, was Re: Clarity over direction of work on runtime and security model?

On Friday, October 4, 2013 at 11:20 AM, Kostiainen, Anssi wrote:

> On Oct 4, 2013, at 10:11 AM, Marcos Caceres <w3c@marcosc.com (mailto:w3c@marcosc.com)> wrote:
> 
> > On Wednesday, October 2, 2013 at 1:44 PM, Kostiainen, Anssi wrote:
> > Adding the ability to define an origin for an application ("e.g., <origin host='com.foo.bar'>") solves the only real outstanding issue for packaged apps: being able to work with CORS-enabled services. This then causes the Origin HTTP header to be: 
> > 
> > Origin: app://com.foo.bar 
> > 
> > (or whatever the developer wants). 
> 
> Are you interested in helping publish an update or an extension to Widgets to specify <origin>?
If implementers want it, yes. 
> This seems like a low hanging fruit to me. Would that be doable process-wise?

We can cross the process bridge when we get to it. It's really not that important. What's important is if implementers want it.  
> > Adding support for CSP tightening (and defining packaged apps in terms of CSP) is a nice to have - specially if developers can control this.
> 
> 
> The same for CSP, perhaps less critical but would be good to get this in on the same pass.
agree.  
> > Personally I think we should kill the idea of a "hosted app" too. Segregating the Web into types of Web apps seems very unhelpful and risks creating badness: some apps may only work if installed, when they should work regardless in all browsers (including legacy ones).
> 
> 
> Right. The web architecture is built around URLs for resource identification, HTTP for client-server interaction, and HTML for representation. HTML is increasingly a bootstrap to load scripts and other resources, but the big picture remains. HTML is the entry point.
Agree.  
> 
> I think we should keep these fundamentals in mind, and make sure what we do in this group fit into this picture. So personally I agree with you on that anything that deviates from the above fundamentals may be detrimental to the long-term health of the Web.

This. Beautifully articulated :) 
 
> > > It seems the runtime-related bits on which to reach consensus on are:
> > > 
> > > * App Manifest
> > Right - and this includes if we really need one. And if we do, what purpose it serves, what is/is-not covered by HTML, etc.
> 
> 
> If there's a real problem this solves, whether this is defined as a bunch of <meta>s, for example, or a JSON document linked to the HTML with a <link>, does not matter, IMO. I think that's what you mean?

Yes, this is what I mean. We need to think through this and make sure we don't just jump on a bandwagon. 
 
> The above two questions apply to this as well.
> 
> > > * App Lifecycle and Events
> > 
> > This affects the Web at large so whatever we come up with, we need to make sure this is a browser solution (not a hosted apps, packaged apps thing).
> 
> Agreed.
> 
> > 
> > > * ServiceWorkers
> > 
> > Nice to tie into the above. 
> 
> Indeed.
> 
> Dave - how close we are in getting this work into an appropriate W3C working group?

There is no spec yet. If we want a spec, then we need to help Alex and Co. write it. It's not a hard requirement this happens as the W3C initially if the licensing on the spec is C0 (which it will be). Once it's ready enough (~1 year), then maybe we should talk about bringing it forward for formal standardization. However, we don't have any idea how ServiceWorkers is going to work so there is no point in trying to standardize just yet- we need to prototype, iterate, ship it, see what happens, then, and only then, standardize it formally. 
 
> I'm wondering if rechartering the group would help align us around the revised goals, assuming we as a group land on a consensus we need to revise the goals and scope.

For ServiceWorkers, I doubt it. We really want that in either WebApps or in the HTMLWG.  
> [On a related note, rechartering DAP helped the group make better progress with its deliverables.]

We should definitely do this for the current set of deliverables. It would be really helpful given what we have learned over the last year.

Received on Friday, 4 October 2013 12:13:41 UTC