Re: [spec-reviews] Strawman spec review for upgrade insecure requests (#54)

> +
> +### IDEA: Allow Sites to Signal That They Are Upgradeable Resources
> +
> +One downside of fetch (and Firefox/Chrome's implementation of mixed content
> +blocking) is that HSTS is applied after mixed content blocking has happened. So
> +sites that are known to support HTTPS are *still* blocked.
> +
> +This spec allows a site to indicate that its subresouces should be upgraded.
> +However, there is still no way for a site to say, "Upgrade me when I am
> +a subresource, because I know I support HTTPS."
> +
> +## End Notes
> +
> +This draft is a very welcome move towards better handling of mixed content
> +blocking. However, in its current form, it entirely depends on the *embedding*
> +site setting the CSP header. We would like to see ways for the *embedded* sites

Yan and I had a long conversation about this with agl yesterday; I'm now (again) convinced that it's a bad idea due to the non-determinism it introduces, and the fact that the non-determinism will almost certainly _not_ effect the site's developer.

---
Reply to this email directly or view it on GitHub:
https://github.com/w3ctag/spec-reviews/pull/54/files#r29857466