Re: Runtime and Security Model for Web Applications

On 07/01/13 19:43, Mounir Lamouri wrote:
> On 29/12/12 17:26, John Lyle wrote:
>> Dear all,
>>
>> I have submitted a 'Security Requirements for System Applications'
>> document as a base for the execution and security model deliverables.
>>
>> http://sysapps.github.com/sysapps/proposals/SecurityModel/RequirementsForSecurityModel.html
> Hi John,
>
> After a quick read of this document, I think what you guys are calling a
> "System Application" would be similar to what we call a signed packaged
> application.
> It's not exactly the same thing but the requirements wouldn't match a
> hosted application ("System applications must be installed before they
> can be executed." and "A system application shall consist of a
> downloadable archive [...]") and you request the package to contain a
> signature and you apply the CSP policies we apply for privileged
> applications.
>

Hi Mounir,

Thanks very for the feedback.  Yes - the requirements is aimed at 
packaged applications.  Perhaps I should have included hosted 
applications as well.  I was surprised that your proposal defined normal 
as well as privileged apps, I (probably incorrectly) assumed the scope 
of this working group was just the privileged apps.

In webinos we actually support both hosted and packaged apps, but we 
require both to be explicitly installed, have manifests, conform to CSP 
restrictions and hosted applications _must_ be served over secure 
connections.  Our opinion was that hosted applications should be 
supported, but that there were such a large range of additional threats 
that they ought to jump through a few hoops before being given access to 
privileged APIs.

Best wishes

John

Received on Tuesday, 8 January 2013 15:13:49 UTC