RE: Discussing security model of sysapps

On Apr 2, 2014 3:18 PM, "POTONNIEE Olivier" <Olivier.POTONNIEE@gemalto.com>
wrote:
>
> Thanks Marcos for the clarification. I agree installable applications are
not strictly necessary, and SW offers a smart way to address offline mode.
> So there are no "installable" apps, but just (pre-)"installed" apps,
running with app:// uri.
> Fine for me, thanks!

Olivier,
Now you lost me completely.  How do you mean that SE-using applications are
distributed and by whom?

Anders

> --
> Olivier
>
>
> > -----Original Message-----
> > From: Marcos Caceres [mailto:w3c@marcosc.com]
> > Sent: Tuesday, April 01, 2014 5:43 PM
> > To: POTONNIEE Olivier; GALINDO Virginie; Dave Raggett
> > Cc: Mounir Lamouri; Wonsuk Lee; public-sysapps@w3.org
> > Subject: RE: Discussing security model of sysapps
> >
> >
> >
> > On April 1, 2014 at 5:30:50 PM, POTONNIEE Olivier
> > (olivier.potonniee@gemalto.com) wrote:
> > > Sorry, I was not trying to be abstract.
> >
> > I know you weren't, was just pre-empting :)
> >
> > > What I can't see in any specifications is:
> > >
> > > As a web application developer, I want to provide an installable
> > > application that users can download an install on their device. How
> > > should I package my application in an interoperable way?
> >
> > You are correct. Apart from [1], this is vendor specific right now.
> >
> > As I've proposed previously, pulling section 5 "Zip Archive" from [1]
> > would suffice (or simply referencing it from somewhere).
> >
> > Then using the manifest spec [2], would give you 95% of what you need.
> > The missing 5% is adding an "origin" member to the manifest to enable
> > the package app to be CORS-compatible.
> >
> > > Or from the other side:
> > >
> > > As a web application user, I browse to an online page that offers an
> > installable web application.
> > > How can I (or the browser) download this application and install it
> > on
> > > my device in an interoperable way?
> >
> > Yes, you are again correct that the group has no spec for this. Again,
> > [1] + [2] could be used, but [1] would need to be modified to support
> > the JSON format instead of XML.
> >
> > The greater question is why would one do that? Why not just
> > "install/bookmark/add-to-homecreen" the web page (and let service
> > workers deal with offline). This is where we land back at the APIs -
> > but most of the APIs we are defining here would not be available to any
> > random "online page".
> >
> > [1] http://www.w3.org/TR/widgets/
> > [2] http://w3c.github.io/manifest/
> >
> >
> >
> >
> >
> >
> >
> >
>
>
> This message and any attachments are intended solely for the addressees
and may contain confidential information. Any unauthorized use or
disclosure, either whole or partial, is prohibited.
> E-mails are susceptible to alteration. Our company shall not be liable
for the message if altered, changed or falsified. If you are not the
intended recipient of this message, please delete it and notify the sender.
> Although all reasonable efforts have been made to keep this transmission
free from viruses, the sender will not be liable for damages caused by a
transmitted virus