- From: Anders Rundgren <anders.rundgren.net@gmail.com>
- Date: Sat, 02 Nov 2013 11:52:42 +0100
- To: Marcos Caceres <w3c@marcosc.com>
- CC: Wonsuk Lee <wonsuk11.lee@samsung.com>, sysapps <public-sysapps@w3.org>
On 2013-11-02 10:44, Marcos Caceres wrote: > > > On Saturday, November 2, 2013, Anders Rundgren wrote: > > Since the current SE API draft _presumes_ signed apps, there must be some way of achieving this. > > > Without knowing anything about SE, why is it presumed? And who is expected to be able > to access this API and why would it not be generally available to developers? I believe Olivier and Dzung should answer this question (since they specified the requirement) but I guess the idea is protecting the SE from access by untrusted code. Cheers Anders > > If it's already unsafe, then thinking that putting a digital signature on it makes it somehow safer is a flawed assumption IMO (the app could be XSS'd, keys could be stolen, etc.). The API should be designed initially with the assumption that it should be available to all application developers. > >
Received on Saturday, 2 November 2013 10:53:18 UTC