Re: Security Use Cases - Very rough first draft

On Fri, Aug 19, 2016 at 12:13 PM, Bill McCoy <whmccoy@gmail.com> wrote:
> Most if not all of these requirements do not seem to be  specific to "Web
> Publications" as the term is defined by DPUB IG.
>
> It is of course true that publications must not compromise the basic
> security model of the Web.
>
> Unfortunately, the definition of that general security model and the
> associated runtime life cycle isn't entirely clear, especially when it comes
> to content and applications stored on / executing from local systems.  And
> I'm not sure it's the job of DPUB IG to attempt to define with precision
> that general model. Or, if we do take on the job of fully defining that
> security model, we should realize we aren't doing it just for "Publications"
> but really for Web content in general.
>
> https://www.w3.org/TR/runtime/ is for example recent work in this area
> started by the now defunct System Applications WG. Some  of this seems very
> applicable to Web Publications. That it's unfinished orphaned work is
> perhaps a warning sign that it may not be an easy job to take on but perhaps
> someone could adopt it (which may be preferable to starting over). Whether
> that's DPUB IG or a successor vs. say the Web Platform WG is another
> question... and I guess to me this is all logically part of the Web Platform
> itself.
>
> EPUB specifications to date have clearly punted on this but one reason was
> that we were hoping that work on Web Applications at W3C would be paving the
> way in terms of more rigorously defining the Web security model especially
> for offline/local content.
>

I think this is a critical part of our work, and one of the major
limitations of EPUB. Right now most EPUB reading systems don't support
scripting, partly because of UI conflicts and partly due to security.
If I write a script on my own website, it's my responsibility. But if
I send that script in an EPUB to Google's Play Store, then it becomes
Google's problem, and why should they trust my code?

Another informative post from Baldur:
https://www.baldurbjarnason.com/notes/some-notes-on-security/

Dave

Received on Friday, 19 August 2016 16:40:29 UTC