Re: [w3ctag/design-reviews] Early design review: opaque-blocklisted-never-sniffed MIME types (#618)

> One of the things we try to emphasise in our explainer guidance is the need to start with user need. Can you elaborate on that a bit?

User impact of ORB and CORB:
- behavior/functionality: no impact (assuming HTTP responses use correct `Content-Type`)
- security: big positive impact - Site Isolation / Out of Process IFrames (OOPIFs) do not offer a meaningful security boundary without ORB and/or CORB.  OOPIFs combined with ORB/CORB are an important piece of defenses against the threat of Spectre-based attacks.
- performance: some risk



-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3ctag/design-reviews/issues/618#issuecomment-806017154