RE: Discussing security model of sysapps

On April 1, 2014 at 11:39:08 AM, POTONNIEE Olivier (olivier.potonniee@gemalto.com) wrote:
> > You say:
> > ... there is a general consensus on using a
> > manifest for the web app's metadata. Browsers can download  
> this along
> > with the rest of the app's components, avoiding the need for  
> packaging.
>  
> There is not interoperable way to do this. The manifest is not  
> sufficient, unless we add additional data in it, to download  
> the full set of application's resources. What is a "packaged"  
> app and how to download it is not specified.

Functionally, a packaged application is the same as a web application. It is a URL space whose resources are scoped to what is available inside a zip file. If the application can access resources outside its origin (i.e., outside of app://), that is controlled via CSP. That's all pretty well specified, AFAIK. 

Can you explain what use cases are missing? Or what is not covered? Preferably, please use an example as I have trouble when things get too abstract. 


-- 
Marcos Caceres

Received on Tuesday, 1 April 2014 19:57:35 UTC