Re: [manifest] Update and call for review

On Wed, May 28, 2014 at 9:39 AM, Anne van Kesteren <annevk@annevk.nl> wrote:

> I don't understand this. That would you mean you'd have to modify the
> content of Gmail to point to this manifest. That sounds bad.
>

To quote Marcos:

The only way one could do what you describe would be for "my own app store"
> to host its own manifests. So:
> http://myownappstore.com/gmail/index.html
>
> Would contain:
> <link rel="manifest"
> href="http://myownappstore.com/gmail/manifest.json">
>
> Which would have:
>
> {
>    "name": "Gmail"
>    "start_url": "http://gmail.com"
> }
>
> This would allow custom stores that provide tailored "app experiences" for
> sites that lack manifests.
>

This is the scenario I was describing. Allowing this to happen has both
benefits (easy to build huge app stores!) and risks (easy to build "fake
apps").

But it sounds as though more people are arguing for the manifest URL and
start URL to be required to be same-origin as each other, which would
prevent this scenario from happening.