Re: Considering the pressure to turn HTTPS into a three-party protocol

On Sun, Feb 15, 2015 at 9:31 PM, Mark Nottingham <[email protected]> wrote:
> Noted. It'd be great if you could address the overall topic, rather than picking at terminology, building straw men, etc...

The overall topic is that you've presented as "An Issue" for the TAG a
question of how users use and administer their machines, and whether
the TAG should intervene. I'm (hopefully clearly) rather opposed to
this.

If this is the criteria for the TAG getting involved, why not focus on
the fact that UAs now tend to expose Developer Tools, and these
Developer Tools may be used for nefarious purposes. [1] Should the TAG
provide guidance on how developers should be allowed to modify the
DOM? Or guidance for Site Authors on how to prevent modifications to
the DOM? Should the W3C provide security UI guidance for users who
open their Developer Tools, discouraging them from the evil that may
await?

You may see it as presenting strawmen, but I'm trying to show how your
stated criteria provides a very shaky foundation, one which quickly
encroaches on things I hope we all know to be Terribly Bad Ideas for
the W3C to be involved in, and hopefully to demonstrate that this is
equally one of those Terribly Bad Ideas.

[1] https://www.facebook.com/help/246962205475854