Re: [whatwg] window.status and window.defaultStatus
On Mon, 25 Jul 2011, Bjartur Thorlacius wrote: > > Are JavaScript implementors willing to reimplement window.status? There are > obvious security problems with drawing an author-provided string where a > certain URI is expected, but could window.defaultStatus not set the name > (_NET_WM_NAME or equivalent) of the script's window and window.status either > override window.defaultStatus temporarily, or sent to the user, e.g. through > Growl or as a Windows toast. > The window name is already accessible to scripts (by modifying the text child > of through the DOM) so no new security concerns are introduced. The > Growl binding might well be better by a new function, though. Historically, window.status support has been removed by browsers. In practice, many browsers no longer have status bars anyway. On Mon, 25 Jul 2011, James Graham wrote: > > If you want OS-level notifications you might be interested in [1] > > [1] http://dev.w3.org/2006/webapi/WebNotifications/ Indeed. -- Ian Hickson U+1047E)\._.,--,'``.fL http://ln.hixie.ch/ U+263A/, _.. \ _\ ;`._ ,. Things that are impossible just take longer. `._.-(,_..'--(,_..'`-.;.'
Re: [whatwg] window.status and window.defaultStatus
On 07/25/2011 05:30 AM, Bjartur Thorlacius wrote: Are JavaScript implementors willing to reimplement window.status? There are obvious security problems with drawing an author-provided string where a certain URI is expected, but could window.defaultStatus not set the name (_NET_WM_NAME or equivalent) of the script's window and window.status either override window.defaultStatus temporarily, or sent to the user, e.g. through Growl or as a Windows toast. The window name is already accessible to scripts (by modifying the text child of through the DOM) so no new security concerns are introduced. The Growl binding might well be better by a new function, though. If you want OS-level notifications you might be interested in [1] [1] http://dev.w3.org/2006/webapi/WebNotifications/
[whatwg] window.status and window.defaultStatus
Are JavaScript implementors willing to reimplement window.status? There are obvious security problems with drawing an author-provided string where a certain URI is expected, but could window.defaultStatus not set the name (_NET_WM_NAME or equivalent) of the script's window and window.status either override window.defaultStatus temporarily, or sent to the user, e.g. through Growl or as a Windows toast. The window name is already accessible to scripts (by modifying the text child of through the DOM) so no new security concerns are introduced. The Growl binding might well be better by a new function, though.
