[chromium-dev] Re: "Clear Strict-Transport-Security state" checkbox added

2009-09-23 Thread =JeffH
> Apparently an announcement message is also en-route to the W3C WebApps > working group. It's in their archives now.. fyi: Strict Transport Security specification http://lists.w3.org/Archives/Public/public-webapps/2009JulSep/1148.html Please send feedback on the spec to the public-weba

[chromium-dev] Re: "Clear Strict-Transport-Security state" checkbox added

2009-09-18 Thread Adam Barth
In case you're still wondering about this topic, a draft of the spec is now public: http://lists.w3.org/Archives/Public/www-archive/2009Sep/att-0051/draft-hodges-strict-transport-sec-05.plain.html Apparently an announcement message is also en-route to the W3C WebApps working group. Adam On Th

[chromium-dev] Re: "Clear Strict-Transport-Security state" checkbox added

2009-09-17 Thread Thomas Van Lenten
FYI: Mac does have this dialog, and it's actually 1 click away, as the there is a menu item in the menu bar to directly invoke it (since Safari and Firefox have menubar entries for this). TVL On Thu, Sep 17, 2009 at 8:20 PM, Adam Barth wrote: > > There's a slight race condition in making variou

[chromium-dev] Re: "Clear Strict-Transport-Security state" checkbox added

2009-09-17 Thread Adam Barth
There's a slight race condition in making various things public. Basically, this is a mechanism a high-security site can use to signal to the browser that it would like strict handling of HTTPS errors. For example, when the site opts into this features, HTTPS certificate errors will be treated as

[chromium-dev] Re: "Clear Strict-Transport-Security state" checkbox added

2009-09-17 Thread Mike Mammarella
There's a published paper about it too: http://www.adambarth.com/papers/2008/jackson-barth.pdf On Thu, Sep 17, 2009 at 4:34 PM, Robert Sesek wrote: > It clears the list of hosts in StrictTransportSecurityState: > > // StrictTransportSecurityState > // > // Tracks which hosts have enabled StrictT

[chromium-dev] Re: "Clear Strict-Transport-Security state" checkbox added

2009-09-17 Thread Robert Sesek
It clears the list of hosts in StrictTransportSecurityState: // StrictTransportSecurityState // // Tracks which hosts have enabled StrictTransportSecurityState. After a host // enables StrictTransportSecurityState, then we refuse to talk to the host // over HTTP, treat all certificate errors as f

[chromium-dev] Re: "Clear Strict-Transport-Security state" checkbox added

2009-09-17 Thread Erik Kay
For those of us who are curious, could someone explain what this does? Erik On Thu, Sep 17, 2009 at 4:20 PM, Finnur Thorarinsson wrote: > +1 to what Peter is saying. > Like Brett, I have no clue what this checkbox means and think it shouldn't > have been added. > However, the question I have..

[chromium-dev] Re: "Clear Strict-Transport-Security state" checkbox added

2009-09-17 Thread Finnur Thorarinsson
+1 to what Peter is saying. Like Brett, I have no clue what this checkbox means and think it shouldn't have been added. However, the question I have... is it appropriate to tuck this in with something like deleting the history (like we do with last session, recently closed tabs, autogenerated key

[chromium-dev] Re: "Clear Strict-Transport-Security state" checkbox added

2009-09-17 Thread Evan Martin
On Thu, Sep 17, 2009 at 3:54 PM, Brett Wilson wrote: > On Thu, Sep 17, 2009 at 3:50 PM, Evan Martin wrote: >> >> On Thu, Sep 17, 2009 at 3:38 PM, Adam Langley wrote: >>> >>> On Thu, Sep 17, 2009 at 3:37 PM, Ben Goodger (Google) >>> wrote: Whoever added this UI, please remove it before I

[chromium-dev] Re: "Clear Strict-Transport-Security state" checkbox added

2009-09-17 Thread Peter Kasting
On Thu, Sep 17, 2009 at 3:31 PM, Adam Langley wrote: > I'm more bothered that people who care about their privacy have the > ability to control the information we store about them. > At the bottom of "Under the Hood" is a button called "Reset to Defaults". This is what we hook to all of the tin

[chromium-dev] Re: "Clear Strict-Transport-Security state" checkbox added

2009-09-17 Thread Brett Wilson
On Thu, Sep 17, 2009 at 3:50 PM, Evan Martin wrote: > > On Thu, Sep 17, 2009 at 3:38 PM, Adam Langley wrote: >> >> On Thu, Sep 17, 2009 at 3:37 PM, Ben Goodger (Google) >> wrote: >>> Whoever added this UI, please remove it before I have to when I get >>> back next week. >> >> Very well, revert

[chromium-dev] Re: "Clear Strict-Transport-Security state" checkbox added

2009-09-17 Thread Evan Martin
On Thu, Sep 17, 2009 at 3:38 PM, Adam Langley wrote: > > On Thu, Sep 17, 2009 at 3:37 PM, Ben Goodger (Google) > wrote: >> Whoever added this UI, please remove it before I have to when I get >> back next week. > > Very well, reverting. Why not #ifdef around it? I fear if you revert you'll nev

[chromium-dev] Re: "Clear Strict-Transport-Security state" checkbox added

2009-09-17 Thread Brett Wilson
On Thu, Sep 17, 2009 at 3:31 PM, Adam Langley wrote: > > On Thu, Sep 17, 2009 at 3:03 PM, Peter Kasting wrote: >> It's disappointing to me that this change was made without any bug in the >> bug database linked, and without any input from a member of the UI team, >> despite the code reviewer (ab

[chromium-dev] Re: "Clear Strict-Transport-Security state" checkbox added

2009-09-17 Thread Ben Goodger (Google)
Thanks! On Thu, Sep 17, 2009 at 3:38 PM, Adam Langley wrote: > On Thu, Sep 17, 2009 at 3:37 PM, Ben Goodger (Google) > wrote: >> Whoever added this UI, please remove it before I have to when I get >> back next week. > > Very well, reverting. > > > AGL > --~--~-~--~~~--

[chromium-dev] Re: "Clear Strict-Transport-Security state" checkbox added

2009-09-17 Thread Adam Langley
On Thu, Sep 17, 2009 at 3:37 PM, Ben Goodger (Google) wrote: > Whoever added this UI, please remove it before I have to when I get > back next week. Very well, reverting. AGL --~--~-~--~~~---~--~~ Chromium Developers mailing list: chromium-dev@googlegroups.com

[chromium-dev] Re: "Clear Strict-Transport-Security state" checkbox added

2009-09-17 Thread Ben Goodger (Google)
Thanks for bringing this up Peter. I don't know what this checkbox is, I've never heard of it. Regardless of the fact that it's N hops away from the main window, we should not be making user visible changes without copying the UX team. Whoever added this UI, please remove it before I have to whe

[chromium-dev] Re: "Clear Strict-Transport-Security state" checkbox added

2009-09-17 Thread Adam Langley
On Thu, Sep 17, 2009 at 3:03 PM, Peter Kasting wrote: > It's disappointing to me that this change was made without any bug in the > bug database linked, and without any input from a member of the UI team, > despite the code reviewer (abarth) explicitly wondering about getting UI > review. Glen r