Re: New editor's draft shuffles sections.

> > RFC 2119-o?
> > "For visual user agents, in usage modes in which browser chrome is 
used to
> > signal security context information, that chrome should always be 
visible
> > during interactions with Web content."
> > For visual user agents, in usage modes in which browser chrome is used 
to
> > signal security context information, that chrome SHOULD always be 
visible
> > during interactions with Web content.
> >
> > Did you want to RFC 2119 this one too?
> > "This requirement is scoped to a specific interaction: When multiple 
Web
> > pages might be displayed, security critical chrome need not be present 
for
> > those with which the user is not currently interacting. However, 
chrome
> > used to communicate security context information that relates to the
> > currently interacted Web page must always remain on the screen."
> > This requirement is scoped to a specific interaction: When multiple 
Web
> > pages might be displayed, security critical chrome MAY NOT be present 
for
> > those with which the user is not currently interacting. However, 
chrome
> > used to communicate security context information that relates to the
> > currently interacted Web page MUST always remain on the screen.
> >

> We don't have a coherent conformance model for that part, at all,
> which should probably be an open issue against it.  Till then,
> detailed discussion about SHOULD, MUST, and the like are pretty much
> futile.

A stake in the ground isn't futile. Can you generate the issue? Or use my 
stake in the ground? 

> > What are the reasons these are SHOULD's instead of MUSTs? Anyone 
know/got
> > an opinion?

> I suspect that that refers to the following text?

> > Web user agents SHOULD restrict window sizing and moving
> > operations consistent with 7.1.2 Keep Security Chrome Visible.
> > This prevents attacks wherein browser chrome is obscured by
> > moving it off the edges of the visible screen. Web user agents
> > SHOULD NOT allow web content to open new windows with the
> > browser's security UI hidden. Allowing this operation facilitates
> > picture-in-picture attacks, where artificial chrome (usually
> > indicating a positive security state) is supplied by the web
> > content in place of the hidden UI.

> No particular preference on my side.

It seems best to start with MUSTs, since you know if that's a bad idea 
we'll hear about it. It's less clear we'll hear about a SHOULD that should 
be a MUST. 


> > If we don't have an issue to track this ambiguity, we need one:
> > "With visual user interfaces that use a windowed interaction paradigm, 
Web
> > user agents [[MAY | SHOULD]] restrict the opening of pop-up windows 
from
> > web content, "
> > SHOULD is my vote

> +1

We need an issue to track this too.