Re: ACTION-509 Cross-frame scripting notes for "Security Considerations" section

On 4 Feb 2009, at 22:14, Close, Tyler J. wrote:

> Thomas Roessler wrote:
>> On 2 Feb 2009, at 23:49, Mary Ellen Zurko wrote:
>>
>>> Thanks Tyler. I get what you're getting at, but am
>> struggling with the
>>> text. I've moved a bit around and tried to be a bit more
>> explicit. I
>>> like this better; other opinions? :
>>
>> I think either variant of the text is fine.
>
> Either variant is fine with me as well.

Let's do a distributed coin toss, then. ;-)

>>> I would also love to close this paragraph with a line such
>> as "Future
>>> security context presentations may find better ways to relay this
>>> complex information to the user in a useful fashion."
>>
>> If we have an idea what that presentation could look like, we
>> should have been working on it.
>
> I did and was. The Petname Tool helps the user assign recognizable  
> names to scripting boundaries.
>
> It's a strange situation where the crucial scripting boundaries are  
> under-specified; whereas the TLS attributes are heavily specified,  
> but mostly irrelevant to security in the browser.

I can't argue with that.

Received on Wednesday, 4 February 2009 21:18:25 UTC