Re: [w3ctag/design-reviews] WebTransport (#389)

Yes, I think that we can avoid the port list and the permissions.  Port scanning can be addressed by having the connection fail with a minimum timeout and no error codes that expose how it failed (maybe with some exceptions that we can carefully vet).  After that, you leak no information until the server consents to communicate with this origin.

The big concerns are that we keep this and the new WebSocket stuff in sync so that they share what they need to (and that we don't do the same work twice).  I'm assured that there is good coordination with Google between the teams, so that much is good.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3ctag/design-reviews/issues/389#issuecomment-628526570