RE: ACTION-509 Cross-frame scripting notes for "Security Considerations" section

 

Thomas Roessler wrote:
> On 2 Feb 2009, at 23:49, Mary Ellen Zurko wrote:
> 
> > Thanks Tyler. I get what you're getting at, but am 
> struggling with the 
> > text. I've moved a bit around and tried to be a bit more 
> explicit. I 
> > like this better; other opinions? :
> 
> I think either variant of the text is fine.

Either variant is fine with me as well.

> > I would also love to close this paragraph with a line such 
> as "Future 
> > security context presentations may find better ways to relay this 
> > complex information to the user in a useful fashion."
> 
> If we have an idea what that presentation could look like, we 
> should have been working on it.

I did and was. The Petname Tool helps the user assign recognizable names to scripting boundaries.

It's a strange situation where the crucial scripting boundaries are under-specified; whereas the TLS attributes are heavily specified, but mostly irrelevant to security in the browser.

--Tyler

Received on Wednesday, 4 February 2009 21:16:30 UTC