W3C home > Mailing lists > Public > public-web-security@w3.org > December 2009

Re: HTTPbis and the Same Origin Policy

From: Maciej Stachowiak <mjs@apple.com>
Date: Thu, 03 Dec 2009 18:10:55 -0800
Cc: Larry Masinter <masinter@adobe.com>, "public-web-security@w3.org" <public-web-security@w3.org>
Message-id: <160C83E0-DE3E-4ECA-8627-C37CFDB6BCEE@apple.com>
To: "Mark S. Miller" <erights@google.com>

On Dec 3, 2009, at 5:43 PM, Mark S. Miller wrote:

> I have heard that the deadline is today. This is the first I have
> heard about this issue as well as its imminent closure. I appeal to
> whoever's judgement is needed for a reasonable extension. I volunteer
> to write a change proposal removing the Origin header from the HTML5
> spec by January 4. May I have that extension?

The proper venue for such a request would be public-html. The details  
of the process and what goes into a Change Proposal are here: <http://dev.w3.org/html5/decision-policy/decision-policy.html 
 >.

I see that you are a member of the HTML Working Group. Notice of this  
deadline was first posted on the public-html mailing list here: <http://lists.w3.org/Archives/Public/public-html/2009Oct/0940.html 
 >

A reminder of the status and deadlines for all issues was sent here: <http://lists.w3.org/Archives/Public/public-html/2009Nov/0625.html 
 >

The deadline was mentioned specifically in the telecon agenda sent  
Tuesday evening and in the telecon this morning: <http://lists.w3.org/Archives/Public/public-html-wg-announce/2009OctDec/0019.html 
 >

This is just a subset of the many times this has been mentioned. I  
believe notice of the deadline has been more than adequate.  
Furthermore, this issue has been open in the tracker since December  
2008.

That being said:

A) If we do not receive a Change Proposal by the deadline, the issue  
will be closed without prejudice, meaning it will not block Last Call;  
but there will be no final decision, so we'll still be able to  
reconsider the issue if presented with a completed Change Proposal.

B) If you volunteer by the original deadline (generously speaking,  
midnight Pacific Time today) and give a specific deadline to be  
finished with a Change Proposal, the Chairs are likely to entertain  
that request.

Regards,
Maciej



>
>
> On Thu, Dec 3, 2009 at 1:35 PM, Larry Masinter <masinter@adobe.com>  
> wrote:
>> Is the "Origin" header generally agreed to be both necessary
>> and sufficient for same-origin-policy work to proceed?
>>
>> Right now, HTML 5 continues to refer to the Origin header as
>> supporting the same-origin policy, and it seemed to me that
>> there was still some disagreement about whether it should
>> be retained.
>>
>> The HTML issue is scheduled to be closed today (Dec 3) -- should it
>> remain open? Would anyone volunteer to write a "change proposal"
>> (re)moving "Origin header" from the HTML5 spec?
>>
>>
>> http://www.w3.org/html/wg/tracker/issues/63
>>
>> Larry
>> --
>> http://larry.masinter.net
>>
>>
>>
>
>
>
> -- 
>    Cheers,
>    --MarkM
>
Received on Friday, 4 December 2009 02:11:36 GMT

This archive was generated by hypermail 2.2.0+W3C-0.50 : Sunday, 19 December 2010 00:16:01 GMT