- From: David Bruant <david.bruant@labri.fr>
- Date: Tue, 11 Oct 2011 12:26:05 +0200
- To: Erik Arvidsson <arv@chromium.org>
- CC: Alex Russell <slightlyoff@google.com>, public-script-coord@w3.org
Le 30/09/2011 20:33, Erik Arvidsson a écrit : > Configurability is part of JavaScript and the web. If you don't want > this I suggest using (...) Caja (...) This particular argument stayed in my mind for quite a long time. Currently, what SES does is, based on a "configurable environment", is to turn most things non-configurable (with initSES.js). > To allow subclassing and allow using monkey patching to fix bugs in implementations. But SES does not prevent monkey-patching to fix implementations. It would be still possible to: 1) load fixes 2) load initSES.js I think that none of us want configurability. What we want is "configurability once", because it offers the potential to fix implementation bugs. But when bugs are fixed, I'm not really sure we need configurability anymore. Reading a program where things are redefined all the time would be a nightmare. Moreover, it leaves security holes. But anyway, "configurability once" means configurability, so I join the side of attributes being configurable in the end. Even more since I discovered that WebIDL does type enforcement on the getter and setters which i'm sure at some point or another one browser will get wrong. David
Received on Tuesday, 11 October 2011 10:26:44 UTC