Re: [w3c/webcomponents] HTML, CSS, and JSON modules shouldn't solely rely on MIME type to change parsing behavior (#839)

> why do you think the no-execute bit should be directly conveyed? I suspect many developers will not really follow all of the security arguments that this thread opened with. By contrast, redundantly writing the type is intuitively meaningful (if annoying).

@littledan Because it's the most direct expression of intent? I should like to think developers are very familiar with the concept of an executable permission bit, even if it's never come up in this context before. They don't need to follow the mechanics of the security concerns earlier, so long as they find it intuitive to understand that importing assets shouldn't run code. In the writing-out-the-format world, they'd still need to understand a reason that that redundancy is necessary, right?

Practically I see executable permission being orthogonal to formats. And besides, the design of a format thing is much more open ended to me (is it all a bunch of host hooks?), and might take much longer than directly addressing the security concern here.

@justinfagnani I'm not sure what host-defined type means in that case, but AFAIU that's solving a different (and harder, larger-scoped imo) problem of multiple representations and then hanging off those representations the "can execute" bit.

Don't get me wrong, I'm totally open to solving the multiple representations problem. What I'm missing is the desire to lump the "can execute" problem together with it.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3c/webcomponents/issues/839#issuecomment-540693977