[Bug 12888] the crossorigin attribute

http://www.w3.org/Bugs/Public/show_bug.cgi?id=12888

--- Comment #17 from Shelley Powers <shelleyp@burningbird.net> 2011-06-15 18:37:57 UTC ---
(In reply to comment #16)
> The purpose of last call and CR is to receive feedback from other groups and
> adjust the specification based on that.
> 
> In this case adjusting based on such feedback required adding an attribute.
> This seems entirely appropriate and within process to me.
> 
> But I do agree that at least sendig an email to the WG list would have been
> apporiate. If that didn't happen then it needs to happen ASAP.

And there can't be an assumption that the HTML WG and people like myself are
just going to passively sit here, either.

I disagree with this change, regardless of how it came about. WebGL has some
major security issues and this change is nothing more than addressing the tip
of the ice berg while ignoring the rest. I think it is more dangerous to add
than not. 

You just don't toss in security changes without due consideration. HTML5 cannot
fix WebGL, and we shouldn't have to even try. 

The WebGL folks should be responding in a controlled manner to the HTML5 Last
Call, with proposed changes, as well as analysis of impact on their effort. How
this change fits into their new security paradigm should be presented. 

We don't even know if the WebGL group has asked for this, or only one member.
We don't even know if all browser companies are on board with this change.

This is not trivial, and shouldn't be approached as a trivial change.

-- 
Configure bugmail: http://www.w3.org/Bugs/Public/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the QA contact for the bug.

Received on Wednesday, 15 June 2011 18:38:05 UTC