On 2015-12-02 9:48 AM, Richard Barnes wrote:
On Wed, Dec 2, 2015 at 12:25 AM, <ryan.sle...@gmail.com> wrote:
On Tuesday, December 1, 2015 at 6:04:30 PM UTC-8, Jonas Sicking wrote:
Oh well. Bummer.
/ Jonas
If it cheers you up any, the 2.0 API that replaces the U2F API uses
promises - http://www.w3.org/Submission/2015/SUBM-fido-web-api-20151120/
Richard, it would help if you could clarify - are you proposing that
Firefox implement the 'old and deprecated' U2F API [1], or the 'fresh and
new and hoping to be standards track' W3C member submission API [2].
I originally wanted to reply with 'good news' that Chrome only shipped
this for google.com, and only for HTTPS, and that we were committed to
the W3C member submission as the path forward, but as I was working to back
up a citation to this, I found out that we submarine-launched the API in
Chrome 40 [3], for all HTTP and HTTPS origins, without an Intent to
Implement / Intent to Ship.
So, speaking solely on my behalf and not that of my employer, sorry that
Chrome put Firefox in this position of "old and busted" and "new hotness",
with "damned either way" as the result. I'm trying to find out more about
this, as well as Chrome and Chromium's future commitments regarding this
API.
That would be awesome, thanks, Ryan!
Do you mind also checking to see if this feature has an associated use
counter in Chrome, and if so, how widely it's being used?
That said, knowing full well that the FIDO Alliance intends the W3C member
submission to the path forward, could you provide greater clarity:
1) What it is you intend to implement?
My initial intent was to propose implementing [1], then implementing [2]
when it's ready. After all, there's a lot in common, and as you say, the
W3C version will be much nicer.
2) If you intend to implement [1], whether or not you'll unship that
if/as/when [2] progresses?
I think we would treat this just like we treat other early-stage things
that get shipped, gradually turning it off when the real thing shows up.
We usually keep such features on Nightly and Aurora and don't let them
ride the trains all the way to release. However in this particular
case, I'm not sure if doing that would make sense if we end up deciding
on not shipping the old API at all.
Given the Chrome situation, and that Edge seems to be working on
implementing the new version of the API
<https://dev.windows.com/en-us/microsoft-edge/platform/status/fido20webapis>,
perhaps we should wait to see if Chrome compat requires us to implement
the v1 of the API, and if not, skip it?
Cheers,
Ehsan
_______________________________________________
dev-platform mailing list
dev-platform@lists.mozilla.org
https://lists.mozilla.org/listinfo/dev-platform
