public-webappsec@w3.org from November 2012 by date

Thursday, 29 November 2012

• RE: [webappsec] Call for Consensus: CSP 1.1 to FPWD Jacob Rossi
• RE: [webappsec] ACTION REQUIRED: Call for Consensus on new WebAppSec WG Charter Hill, Brad
• Re: Trigger a DOM event/error when a CSP violation happens. Mike West
• Re: [webappsec] Call for Consensus: CSP 1.1 to FPWD Mike West
• Re: [webappsec] ACTION REQUIRED: Call for Consensus on new WebAppSec WG Charter Arthur Barstow

Wednesday, 28 November 2012

• Re: UI Safety Obstruction check and transforms David Lin-Shung Huang
• RE: UI Safety Obstruction check and transforms Fred Andrews
• Re: UI Safety Obstruction check and transforms Mountie Lee
• Re: UI Safety Obstruction check and transforms David Lin-Shung Huang
• Re: Trigger a DOM event/error when a CSP violation happens. Dan Veditz
• Re: Trigger a DOM event/error when a CSP violation happens. Dan Veditz
• Re: [webappsec] Call for Consensus: CSP 1.1 to FPWD Adam Barth
• RE: [webappsec] Call for Consensus: CSP 1.1 to FPWD Jacob Rossi
• Re: [webappsec] Call for Consensus: CSP 1.1 to FPWD Eric Chen
• RE: [webappsec] Call for Consensus: CSP 1.1 to FPWD Jacob Rossi
• Re: [webappsec] Call for Consensus: CSP 1.1 to FPWD Adam Barth

Tuesday, 27 November 2012

• Re: [webappsec] Call for Consensus: CSP 1.1 to FPWD Adam Barth
• RE: [webappsec] Call for Consensus: CSP 1.1 to FPWD Fred Andrews
• [webappsec] ACTION REQUIRED: Call for Consensus on new WebAppSec WG Charter Hill, Brad
• [webappsec] Call for Consensus: CSP 1.1 to FPWD Hill, Brad
• Re: Trigger a DOM event/error when a CSP violation happens. Devdatta Akhawe
• Re: Trigger a DOM event/error when a CSP violation happens. Mike West
• Re: Trigger a DOM event/error when a CSP violation happens. Devdatta Akhawe

Thursday, 22 November 2012

• Re: Trigger a DOM event/error when a CSP violation happens. Mike West
• Re: Trigger a DOM event/error when a CSP violation happens. Eduardo' Vela
• Re: Trigger a DOM event/error when a CSP violation happens. Mike West
• Re: RfR: CORS tests - deadline 6 December Karl Dubost

Wednesday, 21 November 2012

• [webappsec] Teleconference Poll: time unchanged Hill, Brad
• Re: RfR: CORS tests - deadline 6 December Boris Zbarsky
• Re: [websec] Call for Consensus: CORS to Candidate Recommendation Adam Barth
• RE: A11y for Web App Sec Anti clickjacking spec Hill, Brad
• RE: CORS test status Hill, Brad
• RfR: CORS tests - deadline 6 December Odin Hørthe Omdal
• Re: CORS test status Odin Hørthe Omdal
• UI Safety Obstruction check and transforms Fred Andrews

Tuesday, 20 November 2012

• Call for Exclusions: User Interface Safety Directives for Content Security Policy Ian Jacobs
• [webappsec] New draft charter for discussion Hill, Brad
• Re: Restricting APIs in CSP Ian Melven
• Re: Please fix! [Pub request: FPWD of User Interface Safety Directives for CSP] Carine Bournez
• Re: Please fix! [Pub request: FPWD of User Interface Safety Directives for CSP] Robin Berjon
• Re: Please fix! [Pub request: FPWD of User Interface Safety Directives for CSP] Carine Bournez
• [webappsec] Agenda for Teleconference of Nov 20, 2012 Hill, Brad
• RE: Please fix! [Pub request: FPWD of User Interface Safety Directives for CSP] Hill, Brad

Monday, 19 November 2012

• [webappsec] TPAC chatlog cleanup Hill, Brad
• Re: how to protect javascript codes Dan Veditz
• Re: how to protect javascript codes Mountie Lee

Sunday, 18 November 2012

• A11y for Web App Sec Anti clickjacking spec Léonie Watson

Saturday, 17 November 2012

• Re: [webappsec] subsume X-XSS-Protection into CSP 1.1? Mike West
• Re: [webappsec] subsume X-XSS-Protection into CSP 1.1? Adam Barth
• Re: [webappsec] subsume X-XSS-Protection into CSP 1.1? Mike West
• Re: how to protect javascript codes Dan Veditz
• Re: how to protect javascript codes Mountie Lee
• Re: how to protect javascript codes Mountie Lee
• RE: how to protect javascript codes Hill, Brad
• Re: how to protect javascript codes Dan Veditz
• how to protect javascript codes Mountie Lee

Friday, 16 November 2012

• Re: Call for Consensus: CORS to Candidate Recommendation Arthur Barstow
• Re: Call for Consensus: CORS to Candidate Recommendation Odin Hørthe Omdal

Thursday, 15 November 2012

• Call for Consensus: CORS to Candidate Recommendation Hill, Brad
• [webappsec] PLEASE RESPOND: poll for new teleconference time Hill, Brad

Tuesday, 13 November 2012

• Re: [webappsec] subsume X-XSS-Protection into CSP 1.1? Adam Barth

Monday, 12 November 2012

• Re: [webappsec] subsume X-XSS-Protection into CSP 1.1? Mike West

Sunday, 11 November 2012

• RE: ISSUE-25: Do frame-options directives (or other UISafety directives) make sense in a meta tag context? Fred Andrews

Friday, 9 November 2012

• [Bug 19920] New: Don't allow space-separated origins in the syntax bugzilla@jessica.w3.org
• Re: [webappsec] subsume X-XSS-Protection into CSP 1.1? Adam Barth

Thursday, 8 November 2012

• RE: [webappsec] subsume X-XSS-Protection into CSP 1.1? Hill, Brad
• Re: [webappsec] subsume X-XSS-Protection into CSP 1.1? neil matatall
• webappsec-ISSUE-40 (X-XSS-Protection): Look at incorporating X-XSS-Protection functionality into CSP 1.1 Web Application Security Working Group Issue Tracker
• Re: [webappsec] subsume X-XSS-Protection into CSP 1.1? Adam Barth
• [webappsec] subsume X-XSS-Protection into CSP 1.1? Hill, Brad

Wednesday, 7 November 2012

• Re: [webappsec] updated draft SVG: simple CORS request Mike West
• RE: [webappsec] updated draft SVG: simple CORS request Hill, Brad
• Re: [webappsec] updated draft SVG: simple CORS request Arthur Barstow

Tuesday, 6 November 2012

• Security model review CSS Masking Dirk Schulze
• [webappsec] Reminder, today's call is CANCELLED Hill, Brad

Monday, 5 November 2012

• RE: Batching CSP violation reports. Jacob Rossi
• Re: Batching CSP violation reports. Alex Russell
• RE: Batching CSP violation reports. Hill, Brad
• Re: Batching CSP violation reports. Mike West
• Re: Batching CSP violation reports. Ian Melven
• Batching CSP violation reports. Mike West
• [webappsec] call for reportURIs DOM API use cases Hill, Brad
• [webappsec] Remote participation in IETF websec meeting Hill, Brad
• Re: Please fix! [Pub request: FPWD of User Interface Safety Directives for CSP] Hill, Brad
• Re: Please fix! [Pub request: FPWD of User Interface Safety Directives for CSP] Thomas Roessler
• RE: Please fix! [Pub request: FPWD of User Interface Safety Directives for CSP] Hill, Brad
• Please fix! [Pub request: FPWD of User Interface Safety Directives for CSP] Carine Bournez
• RE: ISSUE-28: What specific attacks are prevented by OS screenshots, should this be recommended against generally? Hill, Brad
• RE: ISSUE-28: What specific attacks are prevented by OS screenshots, should this be recommended against generally? Hill, Brad
• RE: ISSUE-30: How to address dynamic application of CSP post page load / partial page load via META or script interface Fred Andrews
• RE: ISSUE-28: What specific attacks are prevented by OS screenshots, should this be recommended against generally? Fred Andrews
• RE: ISSUE-26: Does the sandbox directive make sense in a meta tag context? Fred Andrews

Sunday, 4 November 2012

• RE: ISSUE-25: Do frame-options directives (or other UISafety directives) make sense in a meta tag context? Fred Andrews
• RE: Script-nonce policies Hill, Brad

Saturday, 3 November 2012

• Re: ISSUE-38: Discuss no-mixed-content further as a 1.1 experimental directive Dan Veditz
• Re: ISSUE-38: Discuss no-mixed-content further as a 1.1 experimental directive Dan Veditz

Friday, 2 November 2012

• Re: ISSUE-38: Discuss no-mixed-content further as a 1.1 experimental directive Adam Barth
• Re: Script-nonce policies Adam Barth
• Re: ISSUE-38: Discuss no-mixed-content further as a 1.1 experimental directive Ian Melven
• Re: Script-nonce policies Joel Howard Willis Weinberger
• Re: Script-nonce policies Adam Barth
• Re: CSP, style-src, and what it means to ignore style attributes Adam Barth
• Re: Restricting APIs in CSP Dan Veditz
• TPAC meeting adjourned Hill, Brad
• Restricting APIs in CSP Eric Rescorla
• Re: CSP and inline styles Dan Veditz
• ISSUE-39: Discuss CSP relevant use cases for possibly including Meta Referrer as a CSP directive Web Application Security Working Group Issue Tracker
• Re: CSP and inline styles L. David Baron
• ISSUE-38: Discuss no-mixed-content further as a 1.1 experimental directive Web Application Security Working Group Issue Tracker
• ISSUE-37: How to apply plugin-types in CSP 1.1 to iframes Web Application Security Working Group Issue Tracker
• ISSUE-36: Are we interested in considering script-hash as a CSP 1.1 directive? Web Application Security Working Group Issue Tracker
• CSP, style-src, and what it means to ignore style attributes L. David Baron
• ISSUE-35: Should we add an "httpOnly" like directive to CSP to indicate that the state of this policy is not available to the script APIs? Web Application Security Working Group Issue Tracker
• ISSUE-34: Discuss use cases / risks of script access to CSP information, solicit specific public comment on this feature with FPWD Web Application Security Working Group Issue Tracker
• ISSUE-33: Need to address blob, data, filesystem URL types with greater specificity in CSP 1.1 spec Web Application Security Working Group Issue Tracker
• ISSUE-32: Do we specify that path-specificity applies only to hierarchical URI schemes? Web Application Security Working Group Issue Tracker
• ISSUE-31: What specification's definition of URL/URI are we using for path parsing in CSP 1.1? Web Application Security Working Group Issue Tracker
• ISSUE-30: How to address dynamic application of CSP post page load / partial page load via META or script interface Web Application Security Working Group Issue Tracker

Thursday, 1 November 2012

• ISSUE-29: What are sane defaults for clipping with clipping or selectors? Web Application Security Working Group Issue Tracker
• ISSUE-28: What specific attacks are prevented by OS screenshots, should this be recommended against generally? Web Application Security Working Group Issue Tracker
• ISSUE-27: Implementation concern on how to enforce display-time : should we provide more advice on how to do this efficiently? Web Application Security Working Group Issue Tracker
• ISSUE-26: Does the sandbox directive make sense in a meta tag context? Web Application Security Working Group Issue Tracker
• ISSUE-25: Do frame-options directives (or other UISafety directives) make sense in a meta tag context? Web Application Security Working Group Issue Tracker
• ISSUE-24: (); Web Application Security Working Group Issue Tracker
• ISSUE-23: Are there cases of synthetic UIEvents where it would be useful to set the unsafe attribute even if the policy is block so event is not delivered Web Application Security Working Group Issue Tracker
• ISSUE-22: Are there cases of synthetic UIEvents where it would be useful to set the unsafe attribute even if the policy is block (so event is not delivered) Web Application Security Working Group Issue Tracker
• ISSUE-21: Do assistive technologies send real events or synthetic events? Web Application Security Working Group Issue Tracker
• ISSUE-20: If browsers apply this heuristic without an explicit opt-in policy, should we always block and not have the unsafe UIEvent property Web Application Security Working Group Issue Tracker
• updated test VM link Hill, Brad
• Running a few min late Hill, Brad
• TPAC schedule clarification Hill, Brad

Last message date: Thursday, 29 November 2012 20:17:59 UTC