On 2015-04-01 16:11, Anne van Kesteren wrote:
On Wed, Apr 1, 2015 at 3:58 PM, Nilsson, Claes1
<claes1.nils...@sonymobile.com> wrote:
However, work is ongoing in the Web App Sec WG that may provide basis
for a security model for this API. Please read section 4,
http://www.w3.org/2012/sysapps/tcp-udp-sockets/#security-and-privacy-considerations
I don't see anything there that makes TCP or UDP possible. It has
# Explicit trust for the requesting webapp based on the security
# system of the web runtime this API is implemented in.
but no such thing exists (standardized).
Even if there was a technical standard for the web runtime, the distribution
and vetting
of secure applications would probably not be standard which is why I continue
literally
jumping up and down pointing in another direction which is based on COMBINING
the Open Web
with local, more or less proprietary applications which would do the "dirty
work"
(like they already do today).
Unfortunately it seems that the browser vendors want to lock down everything
leaving
Web developers in a very disadvantaged position compared to their
"App"-developing cousins.
Regarding permissions involving the user, there are huge limitations in the
Open Web:
http://webpki.org/papers/permissions.pdf
Anders
