Re: Discussing security model of sysapps

Hi Virginie 

On April 1, 2014 at 6:34:46 AM, GALINDO Virginie (virginie.galindo@gemalto.com) wrote:
> Here are question where I think the SysApp WG should get consensus quickly, in order to  
> make sure we discuss with a common framework:
>  
> - The packaging and the way web application are landing in an environment is not discussed.  
> Will the group address that ?

Distribution of packaged software is fairly well understood. Is there something in particular that we should be describing? I guess we are missing updates.    

> - The permission mechanism is not integrated in the set of specifications related to  
> sysapp or web apps. Furthermore the notion of permission, while being an interesting  
> and important topics is treated in an inconsistent way across W3C. You can have a look  
> at the work done by Dominique [2] in the W3C Web Mobile IG. How will the working group progress  
> on that topic ?

<WebMob IG Chair hat on> - we are looking to expand on that work over the next year and are hoping to coordinate with the TAG. Hopefully from that we will be able to produce a document for discussion. Permissioning is a complicated topic (obviously!), as it has technical, UX, and digital literacy dimensions (and possibly lots of other things that make it extremely challenging to get right). It's unlikely the W3C can solve permissioning, but the community can at least provide some valuable input into the discussion.  

> - The notion of trusted application seemed to be challenged. Where does the WG want to  
> go on that notion ?

Personally, I'd like us to keep building on the Web security model. Making arbitrary exceptions for packaged apps or changing the security model of the Web will lead to fragmentation in the API surface and centralization of distribution. We've seen this with all packaged app ecosystems that have been built in the last 7 years. 

We are beginning to look at the notion of a "trusted application" as part of the manifest in Web apps for when an user explicitly decides to "install/add-to-homescreen/whatever" a web application. If the application meets some predefined criteria (e.g., served over SSL, has a Service Worker, etc.), this may grant some additional privileges to an application by default (e.g., unrestricted storage, higher priority caching etc.)... but we are still at the "research" stage with that.

Received on Tuesday, 1 April 2014 20:07:50 UTC