Re: [webcomponents] Consider exposing Shadom DOM and Custom Elements only in secure contexts (#449)

> The "local testing" argument is pretty bogus.

Tell that to all of the people who use JSBin to mock up web components. There's also several sites out there that would benefit from using web components while not necessarily HTTPS. Some don't even have control over whether or not they use HTTPS.

The "we want to force people to use HTTPS through web components" is a brittle argument. As @rniwa pointed out, web components are a fundamental building block. One of the best examples of this is inspecting a `<select>` or `<input>` with Shadow Root inspection on. These are web components at the browser level. Should these be restricted to HTTPS as well? What makes this so much different?

It's worth being mindful of the voices in this thread who aren't invested in building browsers. There's at least five people in this thread who don't work for browser vendors and aren't part of the W3C, who all are currently against it. At least four of these people write web components on a daily basis and help to maintain polyfills for it. That should say something.




---
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3c/webcomponents/issues/449#issuecomment-200053632