Re: [widgets] Zip vs GZip Tar

On Tue, May 25, 2010 at 10:27 AM, Aaron Boodman <aa@google.com> wrote:
> On Tue, May 25, 2010 at 1:19 AM, Marcos Caceres <marcosc@opera.com> wrote:
>> W3C's widget specs are mature (i.e., most at CR or LC) and the working
>> group believes them to be technically sound and, with a few
>> extensions, able to meet the use cases of [2] (particularly in light
>> of Google using the crx format to package applications - which is more
>> or less identical on a conceptual level to the W3C Widget work).
>
> Note: CRX was modified to support this use case.
>
> I don't think W3C
> widgets would work without similar modifications. Namely the <content>
> element would need to support absolute URLs, and a few other similar
> changes. I'm not sure what effects this would have on the rest of the
> spec, or if it is desirable.

This is certainly something we have always had in mind. However, for
"1.0" we just wanted to support the local case [1]. Supporting
pointing to an external resource is certainly something we could look
at: from the WG's investigations, it has obvious security implications
(i.e., what does it mean for a widget to get its content from a
website? does it mean that the origin of the widget is that domain?
etc. but I'm sure you thought about this stuff already as part of the
Google Web Apps store).

There is certainly few things restricting the working group
investigating this, and writing an extension spec that grants
<content> the ability to support a URI in the src. Also, a Robin notes
in his email, it is technically feasible to distinguish between a
'zip-relative-path' and a URI, so adding this extension in a separate
spec should be no problem... it just needs a good security policy.

[1] http://dev.w3.org/2006/waf/widgets-reqs/#declarative-bootstrap


-- 
Marcos Caceres
Opera Software ASA, http://www.opera.com/
http://datadriven.com.au

Received on Tuesday, 25 May 2010 09:23:35 UTC