> > > but yes, adrienne - perhaps unintentionally - did actually say that > it should be userspace. allow me to quote again the relevant part of > what adrienne (hello adrienne) said: > > On Sun, Apr 15, 2012 at 9:32 PM, Adrienne Porter Felt <a...@berkeley.edu> > wrote: > > Would the following suggestion solve the problem? > > > > * Applications may embed the "magic" photo or videorecord icons. > > *applications* may embed the "magic" photo or videorecord icon(s). > > in other words, the implication is that it is the application which > creates the DOM with the high z-Index to display the videorecord icon. >
Of course we shouldn't trust an app to actually create or insert the element itself. That makes no sense. However, the application needs to indicate where such a button should go. My suggestion is that we discuss the policy first, mechanism later. _______________________________________________ dev-security mailing list dev-security@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-security
