Re: [widgets] Killing file:// of evil (widget URI ready for pub)

On Friday, September 23, 2011 at 6:26 PM, Mark Baker wrote:

> On Thu, Sep 22, 2011 at 7:16 PM, Marcos Caceres
> <marcosscaceres@gmail.com (mailto:marcosscaceres@gmail.com)> wrote:
> Well, this is progress, but it seems the only difference now between
> widget: and http: is the authority. And if that's the case, then
> instead of (from your example);
>  
> widget://c13c6f30-ce25-11e0-9572-0800200c9a66/index.html
>  
> why not go with this?
>  
> http://c13c6f30-ce25-11e0-9572-0800200c9a66.localhost/index.html
That might totally work:) The spec just needs to sandbox the request so apps don't request resources from each other (i.e., I just hope it's not hard to implement a kind of restricted-local-http server that widget:// tries to be… hopefully you get what I mean here: requests/response is instance specific, except where this could be used with postMessage… Also, I was worried about muddying-up the two "protocols", even if they are both http.

Another minor nit is that some runtimes already implement widget:// … but then again, they also implement http, so it might all be ok. Might have a crack at trying to implement this on Android.  

Received on Friday, 23 September 2011 16:42:10 UTC