Re: Value of Server-Sent Events

2009-10-24 Thread Ian Hickson
On Sat, 24 Oct 2009, Michael Nordman wrote: > On Fri, Oct 23, 2009 at 8:45 PM, Ian Hickson wrote: > > On Fri, 23 Oct 2009, Michael Nordman wrote: > > > > > > An area that may be worth exploring, that would add to the list > > > things that go beyond syntactic sugar, could be for multiple > > > d

Re: Value of Server-Sent Events

2009-10-24 Thread Michael Nordman
On Fri, Oct 23, 2009 at 8:45 PM, Ian Hickson wrote: > On Fri, 23 Oct 2009, Michael Nordman wrote: > > > > An area that may be worth exploring, that would add to the list things > > that go beyond syntactic sugar, could be for multiple documents to > > listen in on the same event-stream backed by

Re: [cors] unaddressed security concerns

2009-10-24 Thread Doug Schepers
Hi, Maciej- Maciej Stachowiak wrote (on 10/24/09 4:42 PM): On Oct 24, 2009, at 10:03 AM, Adam Barth wrote: On Fri, Oct 23, 2009 at 10:34 PM, Doug Schepers mailto:schep...@w3.org>> wrote: Sorry for being dense, but why couldn't the whitehats build toy systems on an open honeynet? I suspect

Re: [cors] unaddressed security concerns

2009-10-24 Thread Maciej Stachowiak
On Oct 24, 2009, at 10:03 AM, Adam Barth wrote: On Fri, Oct 23, 2009 at 10:34 PM, Doug Schepers wrote: Sorry for being dense, but why couldn't the whitehats build toy systems on an open honeynet? They could, but what would we learn from such an experiment? If they build only secure syst

CORS Best PRactices (was: [cors] unaddressed security concerns)

2009-10-24 Thread Doug Schepers
Hi, David-Sarah- David-Sarah Hopwood wrote (on 10/24/09 2:07 AM): Currently, the prevalence and impact of CSRF attacks is limited to some extent by the same-origin restrictions. The adoption of CORS will remove part of that limitation. This should be expected to result in more sites that rely o

Re: [cors] unaddressed security concerns

2009-10-24 Thread Adam Barth
On Fri, Oct 23, 2009 at 11:07 PM, David-Sarah Hopwood wrote: > The specific risk is quite clear: it's the risk of CSRF attacks that > are currently prevented (or mitigated) by the same-origin policy. > These won't be prevented or mitigated to the same extent by browsers > that implement CORS. The

Re: [cors] unaddressed security concerns

2009-10-24 Thread Adam Barth
On Fri, Oct 23, 2009 at 10:34 PM, Doug Schepers wrote: > Sorry for being dense, but why couldn't the whitehats build toy systems on > an open honeynet? They could, but what would we learn from such an experiment? If they build only secure systems, then we'd learn that security experts can build

Re: Web Notifications, do we need a new spec?

2009-10-24 Thread Arthur Barstow
On Oct 21, 2009, at 11:04 AM, ext Dominique Hazael-Massieux wrote: (adding the Device APIs Working Group mailing list in CC:) Hi John, Web Apps Le lundi 19 octobre 2009 à 14:12 -0700, John Gregg a écrit : Apologies for the delay, I've been spending the majority of my time completing the initi

Re: [cors] unaddressed security concerns

2009-10-24 Thread Kris Zyp
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 David-Sarah Hopwood wrote: > Doug Schepers wrote: >> I'm not at all a security expert, or even particularly >> well-informed on the topic, but it does occur to me that most of >> CORS' opponents seem very much in the capability-based security >> cam

Re: [cors] unaddressed security concerns

2009-10-24 Thread Doug Schepers
Hi, David-Sarah- David-Sarah Hopwood wrote (on 10/24/09 2:45 AM): Doug Schepers wrote: I'm not at all a security expert, or even particularly well-informed on the topic, but it does occur to me that most of CORS' opponents seem very much in the capability-based security camp [1], and may dis