Re: CfC: Transition "Secure Contexts" to CR; deadline August 2nd.

--001a113ad110a3aed9053817bdbd
Content-Type: text/plain; charset=UTF-8

<hat="individual"> I support this very much.

On Tue, Jul 19, 2016 at 6:22 AM Mike West <[email protected]> wrote:

> Hello, WebAppSec and TAG,
>
> This is a call for consensus to transition Secure Contexts to Candidate
> Recommendation with the document at:
>
> https://w3c.github.io/webappsec-secure-contexts/CR.html
>
> Since the last time we formally discussed this spec, we've cleaned up
> examples and algorithms based on some very helpful feedback from folks at
> Mozilla working on their implementation (thanks Boris and Jonathan!), as
> well as interested folks from the TAG and elsewhere (thanks to Anne and
> Domenic in particular).
>
> The core of the specification is already used in a number of
> specifications to gate certain features (like Service Workers) to contexts
> which offer guarantees about their usage, and browser vendors seem
> interested in implementing.
>
> One substantive change since the last time around is the sandbox behavior
> in
> https://w3c.github.io/webappsec-secure-contexts/CR.html#monkey-patching-sandbox-flags,
> which now defaults to forcing a sandboxed frame into "non-secure context"
> status, and requires a new 'allow-secure-context' token to allow the
> context to be treated as secure. It's not clear whether we can ship that
> change; it's marked as "at risk" pending gathering some metrics.
>
> Note also that this document references WHATWG documents in a few places
> where the W3C version is out of date. I'm sure we'll have some exciting
> conversations about those references:
> https://w3c.github.io/webappsec-secure-contexts/CR.html#index-defined-elsewhere
> contains a complete list.
>
> The deadline for this CfC is in two weeks, on August 2nd. Feedback, both
> positive and negative is welcome, either directly to the list, or via some
> sort of clever emoji response to
> https://github.com/w3c/webappsec-secure-contexts/issues/39.
>
> Thanks!
>
> -mike
>

--001a113ad110a3aed9053817bdbd
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">&lt;hat=3D&quot;individual&quot;&gt; I support this very m=
uch.</div><br><div class=3D"gmail_quote"><div dir=3D"ltr">On Tue, Jul 19, 2=
016 at 6:22 AM Mike West &lt;<a href=3D"mailto:[email protected]">mkwst@goog=
le.com</a>&gt; wrote:<br></div><blockquote class=3D"gmail_quote" style=3D"m=
argin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir=3D"l=
tr">Hello, WebAppSec and TAG,<div><br></div><div><div>This is a call for co=
nsensus to transition Secure Contexts to Candidate Recommendation with the =
document at:<br></div><div><br></div><div><a href=3D"https://w3c.github.io/=
webappsec-secure-contexts/CR.html" target=3D"_blank">https://w3c.github.io/=
webappsec-secure-contexts/CR.html</a><br></div><div><br></div><div>Since th=
e last time we formally discussed this spec, we&#39;ve cleaned up examples =
and algorithms based on some very helpful feedback from folks at Mozilla wo=
rking on their implementation (thanks Boris and Jonathan!), as well as inte=
rested folks from the TAG and elsewhere (thanks to Anne and Domenic in part=
icular).<br></div><div><br></div><div><span style=3D"font-size:12.8px">The =
core of the specification is already used in a number of specifications to =
gate certain features (like Service Workers) to contexts which offer guaran=
tees about their usage, and browser vendors seem interested in implementing=
.</span></div><div><span style=3D"font-size:12.8px"><br></span></div><div><=
span style=3D"font-size:12.8px">One substantive change since the last time =
around is the sandbox behavior in=C2=A0<a href=3D"https://w3c.github.io/web=
appsec-secure-contexts/CR.html#monkey-patching-sandbox-flags" target=3D"_bl=
ank">https://w3c.github.io/webappsec-secure-contexts/CR.html#monkey-patchin=
g-sandbox-flags</a>, which now defaults to forcing a sandboxed frame into &=
quot;non-secure context&quot; status, and requires a new &#39;allow-secure-=
context&#39; token to allow the context to be treated as secure. It&#39;s n=
ot clear whether we can ship that change; it&#39;s marked as &quot;at risk&=
quot; pending gathering some metrics.</span></div><div><br></div><div>Note =
also that this document references WHATWG documents in a few places where t=
he W3C version is out of date. I&#39;m sure we&#39;ll have some exciting co=
nversations about those references:=C2=A0<a href=3D"https://w3c.github.io/w=
ebappsec-secure-contexts/CR.html#index-defined-elsewhere" target=3D"_blank"=
>https://w3c.github.io/webappsec-secure-contexts/CR.html#index-defined-else=
where</a> contains a complete list.</div><div><br></div><div>The deadline f=
or this CfC is in two weeks, on August 2nd. Feedback, both positive and neg=
ative is welcome, either directly to the list, or via some sort of clever e=
moji response to=C2=A0<a href=3D"https://github.com/w3c/webappsec-secure-co=
ntexts/issues/39" target=3D"_blank">https://github.com/w3c/webappsec-secure=
-contexts/issues/39</a>.</div><div><br></div><div>Thanks!</div></div></div>=
<div dir=3D"ltr"><div><div><br clear=3D"all"><div><div>-mike</div></div>
</div></div></div></blockquote></div>

--001a113ad110a3aed9053817bdbd--