Re: [manifest] Define identity of a web app. (#272)

> Yes, we discussed this and concluded that Mozilla's position is that it should define one application.

Great! Are you planning to put some text into the spec that would stress this?

>As I understand it the idea is that the manifest URL authoritatively identifies an app, so the user wants to be sure that foo.com can not create a manifest for bar.com which it has no relationship with. This also makes it possible to resolve the start_url against the manifest URL rather than the document URL, though I don't think the spec says that yet. The manifest URL is used to reason about and to update the app so multiple apps with the same manifest URL can not be installed.

>In building APIs for Firefox OS we've found many instances where apps need to be referred to by some globally unique identifier. Manifest URL makes a great identifier.
>Manifest URL also makes a convenient identifier for search engines which can crawl the web for apps via link relations and know that a linked manifest is an authoritative description of an app.

OK, I get it now - same origin restriction makes it harder to create a manifest for someone else's app. But the manifest doesn't link to the actual application (`start_url` is not mandatory and is only a hint for UAs), it's the application that links to the manifest.
So a sane developer would presumably only link his application to a manifest if they controlled both, right? So why make it harder to host the manifest elsewhere (eg on a CDN)?

Or we could go the other way (more appy, less webby):
* one app per manifest
* manifest on the same origin as app
* `start_url` mandatory in manifest and unambiguously defining application's entry point

---
Reply to this email directly or view it on GitHub:
https://github.com/w3c/manifest/issues/272#issuecomment-78977481