W3C home > Mailing lists > Public > public-webappsec@w3.org > October 2014

Re: [webappsec] Agenda for MONDAY Teleconference 2014-10-20, 12:00 PDT

From: Anne van Kesteren <annevk@annevk.nl>
Date: Mon, 20 Oct 2014 16:56:35 +0200
Message-ID: <CADnb78gN99BhnLh=YKW4nTB_7NhWd5_jozQrLSNTG3sPSL=Fng@mail.gmail.com>
To: Mike West <mkwst@google.com>
Cc: Brad Hill <hillbrad@gmail.com>, "public-webappsec@w3.org" <public-webappsec@w3.org>, Brian Smith <brian@briansmith.org>
On Mon, Oct 20, 2014 at 4:45 PM, Mike West <mkwst@google.com> wrote:
> * Should we split Mixed Content into a document focusing on "Insecure
> content (HTTP) in a secure context (HTTPS)", and another focusing on
> "Intranet content in an extranet context"? Brad(?) suggested this at some
> point in the past, and the more I think about it, the more it probably makes
> sense. +Brian, who has opinions here, I think.

I would prefer less hooks in Fetch (and personally I would prefer
Mixed Content and CSP and such all in one document). Perhaps for Fetch
at some point we can refactor it as a single "security hook" that you
make CSP, Mixed Content, and whatever else we come up with hook into
without getting into ordering trouble.

Received on Monday, 20 October 2014 14:57:02 UTC

This archive was generated by hypermail 2.3.1 : Monday, 23 October 2017 14:54:07 UTC