Re: Discussing security model of sysapps

On April 1, 2014 at 12:30:33 PM, Dave Raggett (dsr@w3.org) wrote:
> > >> ... there is a general consensus on using a
> >> manifest for the web app's metadata. Browsers can download  
> this along
> >> with the rest of the app's components, avoiding the need for  
> packaging.
> > There is not interoperable way to do this. The manifest is not  
> sufficient, unless we add additional data in it, to download  
> the full set of application's resources. What is a "packaged"  
> app and how to download it is not specified.
>  
> I believe that although there is no detailed agreement on packaged  
> apps,
> there is an shared intention to support hosted apps in an interoperable  
> way. I would like to hear more about how the browser determines  
> the
> full set of components to download and cache when "installing"  
> a hosted
> app. My understanding is that the manifest file isn't intended  
> to list
> the app's components. The appcache spec is known to flawed and  
> it would
> be good to get an update on progress on replacing it.

There are details here:
https://github.com/slightlyoff/ServiceWorker/blob/master/explainer.md


> > You say:
> >> Apps may be divided up according to whether they have a digital  
> >> certificate from a trusted third party.
> > The is no specification defining how to attach a signature to  
> a SysApp (there was widget signatures though, but this is not  
> applicable to Sys Apps as is). This is probably something we have  
> to address.
>  
> It looks like we certainly need a standard way to attach signatures  
> to
> hosted apps, and this presumably is tied up to how the set of app  
> components are referenced.


We probably need to describe this problem better - particularly in how it relates to the architecture of the Web. It would be great to not have to go an ask someone for a digital key to be able to access APIs (as this leads to centralization, gate-keeping, and exclusion). We should only do that if all else fails, but should not be our starting point. 

Received on Tuesday, 1 April 2014 20:04:19 UTC