RE: Spec changes for ISSUE-180 change proposal

On Mon, 26 Mar 2012, Ian Hickson wrote:
> On Fri, 16 Mar 2012, Jacob Rossi wrote:
>> 
>> We have reviewed our change proposal for ISSUE-180 [1] since the call 
>> this morning. The details section describes in detail the changes that 
>> we believe need to be made to the specification. The proposed changes 
>> point to the sections of the specification and provide suggested text 
>> to be included. We do not expect anybody to reverse engineer our 
>> implementation. If any working group member believes that there is 
>> implementation information missing from the change proposal, we'd be 
>> happy to discuss that and clarify what we have built.

> The only reason I haven't yet applied this patch is that I need to rewrite the entire sandbox stuff anyway to refactor it for CSP, and I don't want to do the work twice.

I just recently signed up to help write some revised text for the sandbox directive in CSP. I'm happy to work with you on coordinating on what (if any) refactoring is necessary in HTML5 for that.   But right now, you're the only one who knows exactly what changes you think need to be made. :-) As I asked before offline, it'd be great to have clarity on exactly what refactoring you think is necessary so that we can work together on this in the open. We should have a bug opened for this that details the changes that you think are necessary.

> Once I do apply it, I will naturally (as with any patch) try to make sure it matches existing implementations. Unfortunately I can't test IE10 since I don't have a way to run it.

Again, I can help you with any details about the implementations that you think are missing from our proposal.  If you'd like to test IE10 yourself, just about any x86/x64 computer made in the last 5 years can run the preview release as a dual boot [1].

> Since implementations have already gone ahead and implemented this feature without the spec being updated for it, despite the feature really not being that important (why are we even encouraging bad UI like popups at all, let alone in a sandboxed environment?), it really doesn't seem urgent for the feature to be specced, which is why I have prioritised other matters above this one.

Customers have asked us (and other browser vendors) for this feature [2]. It's important to them that the feature be interoperable, and writing down the spec is our tool as a working group to do that. Without this, real customers are blocked from using sandbox in their products and are thus left less secure. A security feature should not prevent a UI on the basis that it is "bad UI," unless that UI somehow invalidates the security of the feature altogether. We first proposed this change a year ago back in March 2011, about 5 or so months before we shipped the first preview with this feature [3,4].

Thanks,

Jacob

[1] http://windows.microsoft.com/en-US/windows-8/download 
[2] http://www.w3.org/html/wg/wiki/ChangeProposals/sandbox_allow_popups#APPENDIX_A 
[3] http://lists.w3.org/Archives/Public/public-html/2011Mar/0679.html
[4] https://www.w3.org/Bugs/Public/show_bug.cgi?id=12393

Received on Thursday, 29 March 2012 16:41:16 UTC