W3C home > Mailing lists > Public > public-webappsec@w3.org > August 2015

Re: CfC: Republish MIX as CR; deadline July 29th.

From: Mike West <mkwst@google.com>
Date: Sun, 9 Aug 2015 07:44:43 +0200
Message-ID: <CAKXHy=eVYLcfw8RXprQgx9vo_YtgTpr9709RTsv33n6QDXRCsA@mail.gmail.com>
To: Anne van Kesteren <annevk@annevk.nl>
Cc: Brian Smith <brian@briansmith.org>, Brad Hill <hillbrad@gmail.com>, Wendy Seltzer <wseltzer@w3.org>, Dan Veditz <dveditz@mozilla.com>, "public-webappsec@w3.org" <public-webappsec@w3.org>
On Thu, Aug 6, 2015 at 11:20 AM, Anne van Kesteren <annevk@annevk.nl> wrote:
> > IMO, it is better to do in Fetch, because then (a) more specifications
> can
> > reference it, (b) people working on changing Fetch and Fetch-based things
> > may more easily notice that it is something that needs to be considered.
> and
> > (c) it is easy to tweak the Fetch spec to improve the definition later,
> if
> > necessary, than it is to improve MIX.
> (c) seems like a bug.

Yes and no, but it's certainly true that we're moving slower than I'd like
on this and other specs. That's partially a process problem, and partially
a "Mike is doing too many things at once, and all poorly." problem.

> (b) rings true. As for (a), nobody could think
> of any other specifications. The other problem I have is how I would
> go about defining this.

I've taken a stab at this question in
(which really just moves around and clarifies the checks already being done
in the spec (and is more easily readable in
https://w3c.github.io/webappsec/specs/mixedcontent/#is-passthrough and the
other algorithm sections)). Adding a bit to the request might be cleaner,
but if the set of properties MIX relies on are in fact reliable, then
there's probably not a real need to add the bit.

WDYT, Brian and Anne?

Received on Sunday, 9 August 2015 05:45:31 UTC

This archive was generated by hypermail 2.4.0 : Friday, 17 January 2020 18:54:50 UTC