Re: [manifest] Native API Permissions (#319)

Okay, so it looks like it may still be too early to discuss details regarding permissions. There appears to be a CG being proposed that will provide guidance to the different WG's.
https://www.w3.org/community/trustperms/
It might be a good idea to wait and see what they have to say.

>You might be interested in reading my privileged hosted apps proposal, and the resulting discussion. The idea is to enumerate the resources (with hashes) in the app manifest, and have a trusted party sign the manifest.
https://groups.google.com/forum/#!msg/mozilla.dev.webapi/pCY77YAg_i4/HxS89bvQ7wsJ

>There are challenges with this proposal such as what origin the resources would be considered being part of, how updates are handled and how distributed the trusted parties can be.

>Another proposal is hosted signed packages https://bugzilla.mozilla.org/show_bug.cgi?id=1036275

>This has similar challenges. Input is welcome!

These may be interesting to us. I will take a deeper look into it. However, @marcoscaceres mentioned earlier:
>Having different tiers of web applications sucks. 

Wouldn't these proposals create even more tiers? Does Mozilla have an overall stance on this? Or am I misinterpreting what is meant by tiers?


>I think what MS is doing, is granting access to a few extra APIs for hosted web apps which are installed through their store.

>Chrome will be granting access to a few extra APIs (being standardized, ie not really proprietary) for hosted web apps installed from the universal store called the world wide web :-)

We are targeting the Store scenario first, but we are not ruling out giving users the ability to install hosted webapps from the web in the future.

>If it possible for you guys to use "ms_permissions" or whatever for now? Then, if we find some APIs that need this across-vendors, we can easily add this. Note that adding this prematurely would only move the vendor-prefixing (and those would still be ignored by other browsers):

I think  we will go with this for now. Thanks for all the input!

---
Reply to this email directly or view it on GitHub:
https://github.com/w3c/manifest/issues/319#issuecomment-77654174