On 3/9/11 10:29 PM, Ryosuke Niwa wrote:
This is sort of a requirement for being able to use components that
you don't trust to arbitrarily mess with your DOM though, no?
We already have very complicated security mechanisms for frames, and the
history of the Web tells us that it's really hard to get them right.
Why can't we reuse the same mechanism instead of introducing new one?
Isn't it as simple as putting an iframe in your component, no?
You mean putting your component in an iframe, to address the issue I
brought up above?
I suppose that could be done, but that involves having an iframe for
things you want to end up using components, which means the markup is
suddenly polluted with these "componentization" hooks.
I would expect that the actual isolation model UAs _implement_ will use
the same infrastructure that frames do. But that doesn't mean we need
actual frames in the markup.
Also notice that we want a slightly different policy here from frames,
in that components do need to be able to define some methods on the
objects they're bound to, right?
-Boris