Re: [webappsec] Rechartering: Sub-Origins

+1

I am also far and away more positive on being able to roll out
sub-origins than caja.

thanks
Dev


On 10 November 2014 11:31, Michal Zalewski <lcamtuf@coredump.cx> wrote:
> The basic reasoning behind suborigins is to provide a very simple,
> intuitive, and low-cost way to compartmentalize applications, reason
> about the compartmentalization, and test it with automated tools.
>
> If I understand it correctly, your critique is that suborigins are a
> bad idea because application compartmentalization can be achieved with
> a bit more work with existing tools. But I think this applies to most
> other mechanisms: we also do not strictly require CSP or referer
> directives or most of the other security work. Almost all of its is
> driven by the desire to just make things simpler, more intuitive, less
> likely to fail, and easier to audit for.
>
> We're definitely acutely aware of Caja and similar solutions and have
> spent years trying to convince product teams to use it in a variety of
> settings :-) I *think* that suborigins will strictly improve status
> quo and has a chance of working out, but of course, no promises.
>
>
> /mz
>

Received on Monday, 10 November 2014 20:01:28 UTC