Thanks, Mike, that looks good. Should we promote the following note (or new language to indicate the same) from section 4.1 to the goals/introduction? Note: We allow only same-origin upgrades in order to ensure that navigations between pages of a single site that has opted-into the upgrade behavior remain on HTTPS, regardless of the hard-coded values in <a> tags. Performing upgrades for third-party resources brings a significantly higher potential for breakage, so we’re avoiding it for the moment. On Wed Feb 11 2015 at 6:04:39 AM Mike West <mkwst@google.com> wrote: > Forking this thread for clarity. > > On Tue, Feb 10, 2015 at 8:07 PM, Brad Hill <hillbrad@gmail.com> wrote: > > I think this spec would be well-served to have an explicit "Goals" > section > > in the introduction describing exactly what can be accomplished and how > it > > compares feature-wise to HSTS. > > A good idea indeed. I've added > https://w3c.github.io/webappsec/specs/upgrade/#goals to the document. > WDYT? > > -mike > > -- > Mike West <mkwst@google.com>, @mikewest > > Google Germany GmbH, Dienerstrasse 12, 80331 München, Germany, > Registergericht und -nummer: Hamburg, HRB 86891, Sitz der Gesellschaft: > Hamburg, Geschäftsführer: Graham Law, Christine Elizabeth Flores > (Sorry; I'm legally required to add this exciting detail to emails. Bleh.) >
Received on Wednesday, 11 February 2015 18:24:49 UTC