public-web-security@w3.org from December 2009 by author

=JeffH

• Re: HTTP Mutual-auth proposal status / HTTP AUTH meet-up in Anaheim? (Tuesday, 29 December)
• following up on STS feedback -- draft-hodges-strict-transport-sec-06.plain.html (Friday, 18 December)
• Re: more flexible ABNF for STS? (=JeffH) (Friday, 18 December)
• Re: Handling multiple headers when only one is allowed (Thursday, 17 December)
• STS and "mixed content" (Part 3 of Re: Feedback on the Strict-Transport-Security specification) (Wednesday, 16 December)
• fyi: wiki/Same_Origin_Policy linked-to by Browser Security Handbook (BSH) (Tuesday, 15 December)
• Re: STS user-agent processing and new max-age values (Friday, 11 December)
• Re: STS and lockCA and EVonly (was: STS and lockCA (Gerv)) (Thursday, 10 December)
• more flexible ABNF for STS? (=JeffH) (Wednesday, 9 December)
• Feedback on the Strict-Transport-Security specification (EricLaw) (Tuesday, 8 December)
• Re: Feedback on the Strict-Transport-Security specification (Adam) (Tuesday, 8 December)
• Re: Feedback on the Strict-Transport-Security specification (part 2) (Tuesday, 8 December)
• Re: Feedback on the Strict-Transport-Security specification (part 1) (Tuesday, 8 December)
• Aryeh's comment thread wrt Strict Transport Security (STS) (Tuesday, 8 December)
• Bil's comment thread wrt Strict Transport Security (STS) (Tuesday, 8 December)
• STS and lockCA (Gerv) (Tuesday, 8 December)
• Jonas' comment thread wrt Strict Transport Security (STS) (Tuesday, 8 December)
• fyi: original thread: HTTPbis and the Same Origin Policy (Wednesday, 2 December)
• wrt wiki/Strict_Transport_Security (Wednesday, 2 December)
• Re: wiki/Same_Origin_Policy (Tuesday, 1 December)
• Re: wiki/Same_Origin_Policy (Tuesday, 1 December)

Adam Barth

• Re: STS and "mixed content" (Part 3 of Re: Feedback on the Strict-Transport-Security specification) (Friday, 18 December)
• Re: Handling multiple headers when only one is allowed (Wednesday, 16 December)
• Re: Risks from CSS injection (Wednesday, 9 December)
• Re: Seamless iframes + CSS3 selectors = bad idea (Tuesday, 8 December)
• Re: Seamless iframes + CSS3 selectors = bad idea (Tuesday, 8 December)
• ACS (was Re: Seamless iframes + CSS3 selectors = bad idea) (Tuesday, 8 December)
• Re: Seamless iframes + CSS3 selectors = bad idea (Tuesday, 8 December)
• Re: Seamless iframes + CSS3 selectors = bad idea (Tuesday, 8 December)
• Re: Seamless iframes + CSS3 selectors = bad idea (Tuesday, 8 December)
• Re: Sandboxed iframes (was Re: Seamless iframes + CSS3 selectors = bad idea) (Tuesday, 8 December)
• Re: Sandboxed iframes (was Re: Seamless iframes + CSS3 selectors = bad idea) (Tuesday, 8 December)
• Re: Seamless iframes + CSS3 selectors = bad idea (Monday, 7 December)
• Re: Seamless iframes + CSS3 selectors = bad idea (Monday, 7 December)
• Re: Seamless iframes + CSS3 selectors = bad idea (Monday, 7 December)
• Re: Sandboxed iframes (was Re: Seamless iframes + CSS3 selectors = bad idea) (Monday, 7 December)
• Re: Sandboxed iframes (was Re: Seamless iframes + CSS3 selectors = bad idea) (Sunday, 6 December)
• Re: call for reviewers: XMLHttpRequest Last Call (Sunday, 6 December)
• Re: Sandboxed iframes (was Re: Seamless iframes + CSS3 selectors = bad idea) (Sunday, 6 December)
• Re: Sandboxed iframes (was Re: Seamless iframes + CSS3 selectors = bad idea) (Sunday, 6 December)
• Re: Seamless iframes + CSS3 selectors = bad idea (Sunday, 6 December)
• Sandboxed iframes (was Re: Seamless iframes + CSS3 selectors = bad idea) (Sunday, 6 December)
• Re: Seamless iframes + CSS3 selectors = bad idea (Sunday, 6 December)
• Re: Seamless iframes + CSS3 selectors = bad idea (Saturday, 5 December)
• Re: Seamless iframes + CSS3 selectors = bad idea (Saturday, 5 December)
• Re: wrt wiki/Strict_Transport_Security (Friday, 4 December)
• What is the same-origin policy for (was Re: The Origin header) (Friday, 4 December)
• Re: related security models to same origin policy (Thursday, 3 December)
• Re: The Origin header (was Re: HTTPbis and the Same Origin Policy) (Thursday, 3 December)
• The Origin header (was Re: HTTPbis and the Same Origin Policy) (Thursday, 3 December)
• Re: HTTPbis and the Same Origin Policy (Thursday, 3 December)
• Re: HTTPbis and the Same Origin Policy (Thursday, 3 December)
• Re: HTTPbis and the Same Origin Policy (Thursday, 3 December)
• Re: HTTPbis and the Same Origin Policy (Thursday, 3 December)
• Re: HTTPbis and the Same Origin Policy (Thursday, 3 December)
• Re: UI issues for security consideration (Tuesday, 1 December)
• Re: wiki/Same_Origin_Policy (Tuesday, 1 December)
• wiki/Same_Origin_Policy (Tuesday, 1 December)

Albert Lunde

• Re: HTTPbis and the Same Origin Policy (Thursday, 3 December)
• related security models to same origin policy (Wednesday, 2 December)

Anne van Kesteren

• Re: call for reviewers: XMLHttpRequest Last Call (Wednesday, 9 December)
• Re: call for reviewers: XMLHttpRequest Last Call (Tuesday, 8 December)

Arthur Barstow

• Request for Comments: LCWD of Widget Access Request Policy spec; deadline 13-Jan-2010 (Monday, 14 December)

Aryeh Gregor

• Re: Risks from CSS injection (Wednesday, 9 December)
• Re: Other CSS attacks (Navigation monitor / History crawler / LAN scanner + attack ) (Wednesday, 9 December)
• Re: Risks from CSS injection (Wednesday, 9 December)

Bil Corry

• Handling multiple headers when only one is allowed (Wednesday, 16 December)

Boris Zbarsky

• Re: Seamless iframes + CSS3 selectors = bad idea (Tuesday, 8 December)
• Re: Sandboxed iframes (was Re: Seamless iframes + CSS3 selectors = bad idea) (Sunday, 6 December)
• Re: Seamless iframes + CSS3 selectors = bad idea (Saturday, 5 December)

Collin Jackson

• Re: Seamless iframes + CSS3 selectors = bad idea (Saturday, 5 December)
• Re: Seamless iframes + CSS3 selectors = bad idea (Saturday, 5 December)

Daniel Glazman

• Re: Risks from CSS injection (Tuesday, 8 December)
• Re: Seamless iframes + CSS3 selectors = bad idea (Tuesday, 8 December)
• Re: Seamless iframes + CSS3 selectors = bad idea (Tuesday, 8 December)
• Re: Seamless iframes + CSS3 selectors = bad idea (Tuesday, 8 December)
• Re: Seamless iframes + CSS3 selectors = bad idea (Monday, 7 December)
• Re: Seamless iframes + CSS3 selectors = bad idea (Monday, 7 December)
• Re: Seamless iframes + CSS3 selectors = bad idea (Monday, 7 December)
• Re: Seamless iframes + CSS3 selectors = bad idea (Monday, 7 December)

Daniel Stenberg

• Re: HTTPbis and the Same Origin Policy (Thursday, 3 December)

Daniel Veditz

• Re: What is the same-origin policy for (was Re: The Origin header) (Monday, 14 December)
• Re: The Origin header (was Re: HTTPbis and the Same Origin Policy) (Friday, 4 December)
• Re: HTTPbis and the Same Origin Policy (Thursday, 3 December)
• Re: HTTPbis and the Same Origin Policy (Thursday, 3 December)

David Lindsay

• Re: Risks from CSS injection (Tuesday, 8 December)
• Re: Seamless iframes + CSS3 selectors = bad idea (Tuesday, 8 December)

David Rogers

• Mobile Security barcamp - 19th January 2010, Sophia Antipolis (Monday, 14 December)

David Singer

• UI issues for security consideration (Tuesday, 1 December)

Devdatta

• Re: Seamless iframes + CSS3 selectors = bad idea (Tuesday, 8 December)
• Re: Seamless iframes + CSS3 selectors = bad idea (Tuesday, 8 December)
• Re: What is the same-origin policy for (was Re: The Origin header) (Monday, 7 December)
• Re: Sandboxed iframes (was Re: Seamless iframes + CSS3 selectors = bad idea) (Sunday, 6 December)

Eduardo Vela

• Other CSS attacks (Navigation monitor / History crawler / LAN scanner + attack ) (Wednesday, 9 December)
• Sandboxed Scripts and Styles on HTML / comments? (idea?) (Wednesday, 9 December)
• Re: Seamless iframes + CSS3 selectors = bad idea (Monday, 7 December)
• javascript URIs on stylesheets/redirections (Monday, 7 December)
• Re: What is the same-origin policy for (was Re: The Origin header) (Monday, 7 December)
• Re: Seamless iframes + CSS3 selectors = bad idea (Sunday, 6 December)
• Seamless iframes + CSS3 selectors = bad idea (Friday, 4 December)
• Re: UI issues for security consideration (Friday, 4 December)

gaz Heyes

• Same origin CSS selector attacks (Thursday, 10 December)
• Re: Risks from CSS injection (Thursday, 10 December)
• Re: Seamless iframes + CSS3 selectors = bad idea (Thursday, 10 December)
• Re: Risks from CSS injection (Wednesday, 9 December)
• Re: Risks from CSS injection (Wednesday, 9 December)
• Re: Seamless iframes + CSS3 selectors = bad idea (Tuesday, 8 December)
• Re: Risks from CSS injection (Tuesday, 8 December)
• Re: Seamless iframes + CSS3 selectors = bad idea (Tuesday, 8 December)
• Re: Seamless iframes + CSS3 selectors = bad idea (Tuesday, 8 December)
• Re: Seamless iframes + CSS3 selectors = bad idea (Tuesday, 8 December)
• Re: Seamless iframes + CSS3 selectors = bad idea (Tuesday, 8 December)
• Re: Seamless iframes + CSS3 selectors = bad idea (Tuesday, 8 December)
• Re: ACS (was Re: Seamless iframes + CSS3 selectors = bad idea) (Tuesday, 8 December)
• Re: Seamless iframes + CSS3 selectors = bad idea (Tuesday, 8 December)
• Re: Seamless iframes + CSS3 selectors = bad idea (Tuesday, 8 December)
• Re: Sandboxed iframes (was Re: Seamless iframes + CSS3 selectors = bad idea) (Tuesday, 8 December)
• Re: Seamless iframes + CSS3 selectors = bad idea (Tuesday, 8 December)
• Re: Seamless iframes + CSS3 selectors = bad idea (Monday, 7 December)
• Re: Seamless iframes + CSS3 selectors = bad idea (Sunday, 6 December)

Ian Hickson

• Re: Sandboxed iframes (was Re: Seamless iframes + CSS3 selectors = bad idea) (Monday, 7 December)
• Re: Seamless iframes + CSS3 selectors = bad idea (Monday, 7 December)
• Re: What is the same-origin policy for (was Re: The Origin header) (Monday, 7 December)
• Re: Sandboxed iframes (was Re: Seamless iframes + CSS3 selectors = bad idea) (Monday, 7 December)
• Re: Sandboxed iframes (was Re: Seamless iframes + CSS3 selectors = bad idea) (Sunday, 6 December)
• Re: Sandboxed iframes (was Re: Seamless iframes + CSS3 selectors = bad idea) (Sunday, 6 December)
• Re: Sandboxed iframes (was Re: Seamless iframes + CSS3 selectors = bad idea) (Sunday, 6 December)
• Re: Seamless iframes + CSS3 selectors = bad idea (Sunday, 6 December)
• Re: Seamless iframes + CSS3 selectors = bad idea (Sunday, 6 December)
• Re: Sandboxed iframes (was Re: Seamless iframes + CSS3 selectors = bad idea) (Sunday, 6 December)
• Re: Seamless iframes + CSS3 selectors = bad idea (Sunday, 6 December)
• Re: Seamless iframes + CSS3 selectors = bad idea (Sunday, 6 December)
• Re: Seamless iframes + CSS3 selectors = bad idea (Sunday, 6 December)

Julian Reschke

• Re: Handling multiple headers when only one is allowed (Thursday, 17 December)
• Re: HTTPbis and the Same Origin Policy (Thursday, 3 December)
• Re: HTTPbis and the Same Origin Policy (Thursday, 3 December)

Larry Masinter

• RE: The Origin header (was Re: HTTPbis and the Same Origin Policy) (Thursday, 3 December)
• RE: HTTPbis and the Same Origin Policy (Thursday, 3 December)

Lisa Dusseault

• Re: UI issues for security consideration (Tuesday, 1 December)

Maciej Stachowiak

• Re: Risks from CSS injection (Wednesday, 9 December)
• Re: Risks from CSS injection (Wednesday, 9 December)
• Risks from CSS injection (Tuesday, 8 December)
• Re: Seamless iframes + CSS3 selectors = bad idea (Tuesday, 8 December)
• Re: Seamless iframes + CSS3 selectors = bad idea (Tuesday, 8 December)
• Re: Seamless iframes + CSS3 selectors = bad idea (Tuesday, 8 December)
• Re: Seamless iframes + CSS3 selectors = bad idea (Tuesday, 8 December)
• Re: Seamless iframes + CSS3 selectors = bad idea (Tuesday, 8 December)
• Re: Seamless iframes + CSS3 selectors = bad idea (Tuesday, 8 December)
• Re: Seamless iframes + CSS3 selectors = bad idea (Tuesday, 8 December)
• Re: Seamless iframes + CSS3 selectors = bad idea (Tuesday, 8 December)
• Re: Sandboxed iframes (was Re: Seamless iframes + CSS3 selectors = bad idea) (Monday, 7 December)
• Re: Sandboxed iframes (was Re: Seamless iframes + CSS3 selectors = bad idea) (Monday, 7 December)
• Re: Seamless iframes + CSS3 selectors = bad idea (Monday, 7 December)
• Re: Seamless iframes + CSS3 selectors = bad idea (Monday, 7 December)
• Re: Seamless iframes + CSS3 selectors = bad idea (Monday, 7 December)
• Re: Sandboxed iframes (was Re: Seamless iframes + CSS3 selectors = bad idea) (Monday, 7 December)
• Re: Sandboxed iframes (was Re: Seamless iframes + CSS3 selectors = bad idea) (Monday, 7 December)
• Re: Sandboxed iframes (was Re: Seamless iframes + CSS3 selectors = bad idea) (Sunday, 6 December)
• Re: Sandboxed iframes (was Re: Seamless iframes + CSS3 selectors = bad idea) (Sunday, 6 December)
• Re: Seamless iframes + CSS3 selectors = bad idea (Sunday, 6 December)
• Re: Seamless iframes + CSS3 selectors = bad idea (Sunday, 6 December)
• Re: Seamless iframes + CSS3 selectors = bad idea (Sunday, 6 December)
• Re: Seamless iframes + CSS3 selectors = bad idea (Sunday, 6 December)
• Re: Seamless iframes + CSS3 selectors = bad idea (Sunday, 6 December)
• Re: Seamless iframes + CSS3 selectors = bad idea (Sunday, 6 December)
• Re: Seamless iframes + CSS3 selectors = bad idea (Sunday, 6 December)
• Re: The Origin header (was Re: HTTPbis and the Same Origin Policy) (Friday, 4 December)
• Re: HTTPbis and the Same Origin Policy (Friday, 4 December)
• Re: HTTPbis and the Same Origin Policy (Friday, 4 December)
• Re: The Origin header (was Re: HTTPbis and the Same Origin Policy) (Friday, 4 December)
• Re: HTTPbis and the Same Origin Policy (Thursday, 3 December)
• Re: HTTPbis and the Same Origin Policy (Thursday, 3 December)
• Re: HTTPbis and the Same Origin Policy (Thursday, 3 December)

Mark Nottingham

• Re: Handling multiple headers when only one is allowed (Thursday, 17 December)

Mark S. Miller

• Re: HTTPbis and the Same Origin Policy (Friday, 4 December)
• Re: HTTPbis and the Same Origin Policy (Friday, 4 December)
• Re: The Origin header (was Re: HTTPbis and the Same Origin Policy) (Thursday, 3 December)
• Re: HTTPbis and the Same Origin Policy (Thursday, 3 December)

Mary Ellen Zurko

• Re: Seamless iframes + CSS3 selectors = bad idea (Wednesday, 9 December)
• Re: The Origin header (was Re: HTTPbis and the Same Origin Policy) (Friday, 4 December)
• Re: wrt wiki/Strict_Transport_Security (Friday, 4 December)
• Re: UI issues for security consideration (Tuesday, 1 December)

Michal Zalewski

• Re: Handling multiple headers when only one is allowed (Thursday, 17 December)
• Re: Handling multiple headers when only one is allowed (Wednesday, 16 December)

Sid Stamm

• STS user-agent processing and new max-age values (Friday, 11 December)

Sigbjørn Vik

• Cross Site Attacks (Monday, 7 December)

sird@rckc.at

• Re: What is the same-origin policy for (was Re: The Origin header) (Monday, 14 December)
• Re: call for reviewers: XMLHttpRequest Last Call (Wednesday, 9 December)
• Re: call for reviewers: XMLHttpRequest Last Call (Wednesday, 9 December)
• Re: Seamless iframes + CSS3 selectors = bad idea (Tuesday, 8 December)
• Re: Seamless iframes + CSS3 selectors = bad idea (Tuesday, 8 December)
• Re: Seamless iframes + CSS3 selectors = bad idea (Tuesday, 8 December)
• Re: Seamless iframes + CSS3 selectors = bad idea (Tuesday, 8 December)
• Re: ACS (was Re: Seamless iframes + CSS3 selectors = bad idea) (Tuesday, 8 December)
• Re: call for reviewers: XMLHttpRequest Last Call (Tuesday, 8 December)
• Re: Seamless iframes + CSS3 selectors = bad idea (Tuesday, 8 December)
• Re: ACS (was Re: Seamless iframes + CSS3 selectors = bad idea) (Tuesday, 8 December)
• Re: Seamless iframes + CSS3 selectors = bad idea (Tuesday, 8 December)
• Re: ACS (was Re: Seamless iframes + CSS3 selectors = bad idea) (Tuesday, 8 December)
• Re: Seamless iframes + CSS3 selectors = bad idea (Tuesday, 8 December)
• Re: Seamless iframes + CSS3 selectors = bad idea (Tuesday, 8 December)
• Re: Seamless iframes + CSS3 selectors = bad idea (Tuesday, 8 December)
• Re: Sandboxed iframes (was Re: Seamless iframes + CSS3 selectors = bad idea) (Tuesday, 8 December)
• Re: Sandboxed iframes (was Re: Seamless iframes + CSS3 selectors = bad idea) (Tuesday, 8 December)
• Re: Sandboxed iframes (was Re: Seamless iframes + CSS3 selectors = bad idea) (Tuesday, 8 December)
• Re: Seamless iframes + CSS3 selectors = bad idea (Monday, 7 December)
• Re: Seamless iframes + CSS3 selectors = bad idea (Monday, 7 December)
• Re: What is the same-origin policy for (was Re: The Origin header) (Monday, 7 December)
• Re: What is the same-origin policy for (was Re: The Origin header) (Monday, 7 December)
• Re: call for reviewers: XMLHttpRequest Last Call (Sunday, 6 December)
• Re: Sandboxed iframes (was Re: Seamless iframes + CSS3 selectors = bad idea) (Sunday, 6 December)
• Re: Sandboxed iframes (was Re: Seamless iframes + CSS3 selectors = bad idea) (Sunday, 6 December)
• Re: Seamless iframes + CSS3 selectors = bad idea (Sunday, 6 December)
• Re: Sandboxed iframes (was Re: Seamless iframes + CSS3 selectors = bad idea) (Sunday, 6 December)
• Re: Seamless iframes + CSS3 selectors = bad idea (Sunday, 6 December)
• Re: Seamless iframes + CSS3 selectors = bad idea (Sunday, 6 December)
• Re: Seamless iframes + CSS3 selectors = bad idea (Sunday, 6 December)
• Re: Sandboxed iframes (was Re: Seamless iframes + CSS3 selectors = bad idea) (Sunday, 6 December)
• Re: Seamless iframes + CSS3 selectors = bad idea (Sunday, 6 December)
• Re: Seamless iframes + CSS3 selectors = bad idea (Sunday, 6 December)
• Re: Seamless iframes + CSS3 selectors = bad idea (Saturday, 5 December)

Steingruebl, Andy

• RE: STS and "mixed content" (Part 3 of Re: Feedback on the Strict-Transport-Security specification) (Monday, 28 December)

Thomas Roessler

• Re: Handling multiple headers when only one is allowed (Wednesday, 16 December)
• Re: Seamless iframes + CSS3 selectors = bad idea (Tuesday, 8 December)
• Re: Seamless iframes + CSS3 selectors = bad idea (Sunday, 6 December)
• Re: Seamless iframes + CSS3 selectors = bad idea (Sunday, 6 December)
• call for reviewers: XMLHttpRequest Last Call (Sunday, 6 December)
• Welcome to the W3C web security mailing list (Tuesday, 1 December)

Tyler Close

• Re: HTTPbis and the Same Origin Policy (Thursday, 3 December)
• Re: HTTPbis and the Same Origin Policy (Thursday, 3 December)
• Re: HTTPbis and the Same Origin Policy (Thursday, 3 December)
• Re: HTTPbis and the Same Origin Policy (Thursday, 3 December)
• Re: HTTPbis and the Same Origin Policy (Wednesday, 2 December)
• Re: HTTPbis and the Same Origin Policy (Wednesday, 2 December)

Yngve N. Pettersen (Developer Opera Software ASA)

• Re: Handling multiple headers when only one is allowed (Wednesday, 16 December)

Yutaka OIWA

• Re: HTTP Mutual-auth proposal status / HTTP AUTH meet-up in Anaheim? (Tuesday, 29 December)
• HTTP Mutual-auth proposal status / HTTP AUTH meet-up in Anaheim? (Thursday, 24 December)

Last message date: Tuesday, 29 December 2009 06:51:15 UTC