RE: Access to localhost to be outlawed?

2015-03-17 Thread SULLIVAN, BRYAN L
I agree. Using the browser to access local-exposed HTTP resources is an 
important way to bridge the native/mobile gap. User permission (pre-arranged, 
persistent, or session-based) can be explicitly required if needed, but blanket 
prohibition on intra-device communication via HTTP is too blunt-force a 
response to potential risks from malicious sites. Other efforts (e.g. content 
security policies) should also be limiting the prevalence of such attacks over 
time.

Bryan

-Original Message-
From: Anders Rundgren [mailto:anders.rundgren@gmail.com] 
Sent: Monday, March 16, 2015 11:57 PM
To: public-webapps
Subject: Access to localhost to be outlawed?

https://code.google.com/p/chromium/issues/detail?id=378566

Since popular services like DropBox and Spotify depend on this non-standardized
way of bypassing the browser, I think this strengthens my argument that we 
really
need a standard way to do this.

The time for that is now.

Anders



RE: [Push] one or many

2014-10-09 Thread SULLIVAN, BRYAN L
This is one of those semantics rabbit-holes that I request we avoid. The term 
webapp is well-known (5m hits on google in the common forms “webapp” “web 
app”, etc).
In comparison, “web page” is probably a more amorphous and anachronistic term 
and provides less valuable context for the user/developer of specs. The web is 
a distributed application framework. In “modern” terms it serves apps that are 
implemented using web tech (the essential meaning of “webapp”).

Thanks,
Bryan Sullivan | Service Standards | ATT

From: Michael van Ouwerkerk [mailto:mvanouwerk...@google.com]
Sent: Thursday, October 09, 2014 11:58 AM
To: Anne van Kesteren
Cc: Brian Kardell; public-weba...@w3c.org
Subject: Re: [Push] one or many

I filed an issue regarding the term webapp:
https://github.com/w3c/push-api/issues/77

/m


On Thu, Oct 9, 2014 at 7:52 PM, Michael van Ouwerkerk 
mvanouwerk...@google.commailto:mvanouwerk...@google.com wrote:
Indeed, the spec is currently inconsistent about registrations. The current 
intention is to have one per ServiceWorkerRegistration (i.e. per service 
worker). See for more details and discussion:
https://github.com/w3c/push-api/issues/71

The term webapp does seem a bit odd to me. It's really just a web page. Is 
there a reusable concept I can link to for that?

/m


On Thu, Oct 9, 2014 at 7:08 PM, Anne van Kesteren 
ann...@annevk.nlmailto:ann...@annevk.nl wrote:
On Thu, Oct 9, 2014 at 8:06 PM, Brian Kardell 
bkard...@gmail.commailto:bkard...@gmail.com wrote:
 They do define it in the spec at least[1], but I don't see how it can
 mean both things.

 [1] http://www.w3.org/TR/push-api/#dfn-webapp

That's not a definition that means anything. As I said, it's not grounded.


--
https://annevankesteren.nl/




RE: [Webpush] IETF proposes new Web-Based Push Notifications Working Group

2014-09-26 Thread SULLIVAN, BRYAN L
I agree. I'll help get this out the door asap, likely next week.

Thanks,
Bryan Sullivan | Service Standards | ATT

-Original Message-
From: Arthur Barstow [mailto:art.bars...@gmail.com] 
Sent: Friday, September 26, 2014 5:44 AM
To: Michael van Ouwerkerk; Bryan Sullivan; EDUARDO FULLEA CARRERA
Cc: public-webapps
Subject: Re: [Webpush] IETF proposes new Web-Based Push Notifications Working 
Group

On 9/24/14 1:21 PM, Michael van Ouwerkerk wrote:
 The linked working draft is now more than a year old. The latest 
 editor's draft has some inconsistencies while we transition to a 
 service worker based system, but it's much closer to the current 
 discussions:
 https://w3c.github.io/push-api/

Thanks for pointing this out Mike. Since the ED uses respec, it's 
trivial to prepare a new WD for publication.

Bryan, Eduardo - given IETF directly refers to the TR version of Push 
API, I recommend we publish a new WD for Push API? [1] gets us pretty 
close and I can help. OK?

-Thanks, AB

[1] 
https://w3c.github.io/push-api/?specStatus=WD;publishDate=2014-10-02;previousPublishDate=2013-08-15




[April2014Meeting] New PushAPI ED uploaded

2014-04-09 Thread SULLIVAN, BRYAN L
Hi all,

I have updated the PushAPI ED for a variety of recent discussions including 
many of the TAG review comments. The new ED is at 
https://dvcs.w3.org/hg/push/raw-file/tip/index.html. This ED will be the basis 
for discussions at the F2F, which I will be dialing into.

Here is a summary of the changes since the last ED:
-  Added optional registerOptions parameter in register interface.
-  Added optional body in push message
-  Remove System Messages: changed references to System Messages 
to events generically. System Messages section was renamed Push Events.
-  Globally changed notification to message.
-  Added 7.3 Push Registration Persistence to clarify how 
registrations preserved between sessions.
-  Added 5.1 Push Server Discovery and API Use to illustrate how 
webapps may (hypothetically) determine the applicable push system, and use Push 
API data in Push Server API requests.
-  Edited 5. Push Framework for clarity, to clarify what 
information is passing through push service, and how user-agents are 
authenticated.
-  Updated the example code based upon Alex's service worker based 
example. It needs to be enhanced to include other push systems as examples, 
e.g. include their data in the registerOptions.
-  Added 7.4 Push Registration Uniqueness to clarify for TAG 
comment that same-origin webpages do not share registrations.
-  Added text to 7.3 Push Registration Persistence to clarify for 
TAG comment that how user-agents invoke inactive webapp is not described 
here... expected in Service Workers
-  Added text to 3. Terminology and 4. Security and privacy 
considerations for TAG comment, to clarify what is meant by express 
permission
-  In 7.2 Steps, per TAG comment removed the text or 
alternatively that the requesting webapp has permission to deactivate such push 
registration, focusing the NoModificationAllowedError purely on the validity 
of the passed pushRegistrationId for this webapp.
-  Added notes for consideration of various TAG comments and 
suggestions.
-  Added text to 7.4 Push Registration Uniqueness for TAG 
comment, to clarify that webapp association of specific registrations to 
message streams or sources is an application-layer concern, and that webapp 
servers can provide means to map registrations to specific webapp 
features/functions as needed.
-  Fixed various missing anchors to code elements
-  Fixed respec issues
-  Fixed normative vs informative reference issues

Thanks,
Bryan Sullivan | Service Standards | ATT



RE: [April2014Meeting] Seeking status and plans from Editors not attending meeting; deadline April 9

2014-04-02 Thread SULLIVAN, BRYAN L
I will attend the meeting remotely. I assume there will be remote participation 
support.

Re the Push API, we are working on an ED for TAG feedback and other input from 
browser vendors. An updated ED will be provided before the meeting.

-Original Message-
From: Arthur Barstow [mailto:art.bars...@nokia.com] 
Sent: Wednesday, April 02, 2014 4:05 AM
To: Hallvord Steen; Travis Leithead; Gary Kacmarcik (Кошмарчик); Eric 
Uhrhane; Ted Mielczarek; Scott Graham; Vincent Scheib; Kinuko Yasuda; Bryan 
Sullivan; EDUARDO FULLEA CARRERA
Cc: public-webapps
Subject: [April2014Meeting] Seeking status and plans from Editors not attending 
meeting; deadline April 9

Hi All,

The people in the To: list are spec Editors that are not registered for 
WebApps' April 10-11 meeting. Since you _won't_ attend the meeting, I 
would appreciate it if you would please provide a short status, plans, 
expectations and such for your spec(s). In general: what are the major 
issues blocking the spec; implementation status; testing status; what 
can others do to help; plan for next Technical Report publication; etc. 
Here are the specs including more specific questions for a few:

* Clipboard: Hallvord;

* D3E: Travis and Gary; plan and expectations to get the spec back to 
LC; testing status

* DOM PS: Travis; plan and expectations to get the spec back to LC

* File API: {Directories and System, Writer}; Eric

* Gamepad: Ted and Scott; plan and expectations to get the spec to 
feature complete state (aka Last Call) and implementation status

* Push API: Bryan and Eduardo; plan to address TAG feedback

* Quota: Kinuko

Please send your status by April 9 at the latest (and feel free to use a 
spec-specific Subject: such as [quota-api]).

If you are a spec Editor and _will_ attend the meeting, please feel free 
to provide your status info in advance of the meeting although you will 
have an opportunity to discuss your spec at the meeting.

-Thanks, AB

[PubStatus] http://tinyurl.com/WebAppsWG-PubStatus
[Bugs] http://tinyurl.com/WebAppsWG-Bugzilla




Re: [push] Consider renaming push notification to push message in the Push API spec

2014-03-13 Thread SULLIVAN, BRYAN L
I agree, Push Message is the term that is used in other standards e.g. OMA 
Push. The use of the term notification was a reflection of the current 
simplified API design which provides only a trigger to the application, as a 
notification that some data is available at the server. As we consider the 
introduction of an optional payload into the API, the term Push Message becomes 
more appropriate.

Thanks,
Bryan Sullivan

On Mar 10, 2014, at 11:23 PM, Jeffrey Yasskin 
jyass...@google.commailto:jyass...@google.com wrote:

The term push notification in
https://dvcs.w3.org/hg/push/raw-file/tip/index.html#dfn-push-notification
seems to confuse people into thinking that the user will be
notified/bothered when such a message arrives. This is reinforced by
the fact that iOS uses push notification for exactly that: a way to
notify the user based on a message from a server. See
https://developer.apple.com/library/ios/documentation/NetworkingInternet/Conceptual/RemoteNotificationsPG/Chapters/WhatAreRemoteNotif.html.

Since the spec already uses the name PushMessage for the thing
delivered by a push notification
(https://dvcs.w3.org/hg/push/raw-file/tip/index.html#pushmessage-interface),
it seems like push message would be a good replacement for the
current ambiguous name.

Thanks,
Jeffrey Yasskin

P.S. I'm not subscribed to public-webapps@, so please cc me if you
want me to reply.




Re: [push] Consider renaming push notification to push message in the Push API spec

2014-03-13 Thread SULLIVAN, BRYAN L
Sure, we will look out for additional potentially confusing term overlap as 
suggested.

Thanks,
Bryan Sullivan

On Mar 11, 2014, at 12:38 PM, Michael van Ouwerkerk 
mvanouwerk...@google.commailto:mvanouwerk...@google.com wrote:

I think that's a great suggestion Jeffrey.

Specifically, I would like to avoid confusing concepts and terminology in the 
Push API with those in Web Notifications: http://www.w3.org/TR/notifications/

This is important because these two APIs are often discussed together: an app 
might display a notification to the user after receiving a push message from 
the server.

Regards,

Michael



On Mon, Mar 10, 2014 at 6:14 PM, Jeffrey Yasskin 
jyass...@google.commailto:jyass...@google.com wrote:
The term push notification in
https://dvcs.w3.org/hg/push/raw-file/tip/index.html#dfn-push-notification
seems to confuse people into thinking that the user will be
notified/bothered when such a message arrives. This is reinforced by
the fact that iOS uses push notification for exactly that: a way to
notify the user based on a message from a server. See
https://developer.apple.com/library/ios/documentation/NetworkingInternet/Conceptual/RemoteNotificationsPG/Chapters/WhatAreRemoteNotif.html.

Since the spec already uses the name PushMessage for the thing
delivered by a push notification
(https://dvcs.w3.org/hg/push/raw-file/tip/index.html#pushmessage-interface),
it seems like push message would be a good replacement for the
current ambiguous name.

Thanks,
Jeffrey Yasskin

P.S. I'm not subscribed to public-webapps@, so please cc me if you
want me to reply.





Re: [push] Consider renaming push notification to push message in the Push API spec

2014-03-13 Thread SULLIVAN, BRYAN L
Sure, but this is only a reflection of the semantic space of the English 
language. Many things can be source of confusion. Understanding context is the 
responsibility of the reader. We will do what we can to provide clarifying 
guidance on the use of terms, but Push Message is a well-established term, as 
well Push Notification. The question, which has to be answered by 
understanding the context, is who or what is the recipient. Note that even the 
term Server can be tricky as client and server roles can apply to various 
software entities executing on different devices or even the same device.

Thanks,
Bryan Sullivan

On Mar 13, 2014, at 8:24 AM, Mark Nottingham 
m...@mnot.netmailto:m...@mnot.net wrote:

FWIW, we also have “Server Push” in HTTP/2; that seems confusable as well…


On 11 Mar 2014, at 7:36 pm, Michael van Ouwerkerk 
mvanouwerk...@google.commailto:mvanouwerk...@google.com wrote:

I think that's a great suggestion Jeffrey.

Specifically, I would like to avoid confusing concepts and terminology in the 
Push API with those in Web Notifications: http://www.w3.org/TR/notifications/

This is important because these two APIs are often discussed together: an app 
might display a notification to the user after receiving a push message from 
the server.

Regards,

Michael



On Mon, Mar 10, 2014 at 6:14 PM, Jeffrey Yasskin 
jyass...@google.commailto:jyass...@google.com wrote:
The term push notification in
https://dvcs.w3.org/hg/push/raw-file/tip/index.html#dfn-push-notification
seems to confuse people into thinking that the user will be
notified/bothered when such a message arrives. This is reinforced by
the fact that iOS uses push notification for exactly that: a way to
notify the user based on a message from a server. See
https://developer.apple.com/library/ios/documentation/NetworkingInternet/Conceptual/RemoteNotificationsPG/Chapters/WhatAreRemoteNotif.html.

Since the spec already uses the name PushMessage for the thing
delivered by a push notification
(https://dvcs.w3.org/hg/push/raw-file/tip/index.html#pushmessage-interface),
it seems like push message would be a good replacement for the
current ambiguous name.

Thanks,
Jeffrey Yasskin

P.S. I'm not subscribed to public-webapps@, so please cc me if you
want me to reply.




--
Mark Nottingham   http://www.mnot.net/






Re: [push-api] Dependency on System Messages

2014-03-13 Thread SULLIVAN, BRYAN L
One of the other changes in progress is to include service workers on the 
design of the API. I don't know if that replaces system messages in total but 
the necessary changes will be considered when a new draft is submitted.

Thanks,
Bryan Sullivan

On Mar 13, 2014, at 12:40 PM, Arthur Barstow 
art.bars...@nokia.commailto:art.bars...@nokia.com wrote:

Hi Bryan, Eduardo, All,

While working through the push notification versus push message thread, I 
noticed Push API directly refers to System Messages as defined by SysApps' 
[runtime] spec. Based on the Note at the top of [runtime], it appears work on 
that spec has stopped. As such, what is the plan for the Push API spec 
regarding the dependency on the System Messages feature?

-Thanks, AB

[runtime] http://runtime.sysapps.org/



RE: [push-api] No clear mention of privacy implication of sending data through push service

2014-02-17 Thread SULLIVAN, BRYAN L
Thanks for the comments, Tobie. I will provide an update draft proposal soon to 
address them.
Note also that I'm preparing a proposal to actually include a message body, and 
other enhancements to the current API to broaden support among browsers. I 
should have a draft for review in the next couple of weeks.
Given that such a body would be optional, it would be good in any event to 
include a flow as you propose.

Thanks,
Bryan Sullivan

From: Tobie Langel [mailto:tobie.lan...@gmail.com]
Sent: Monday, February 17, 2014 4:02 AM
To: public-webapps@w3.org
Subject: [push-api] No clear mention of privacy implication of sending data 
through push service

Hi,

Was just skimming through the Push API spec.

I'm aware that no payload is sent with push message for privacy reasons (as 
push service is most certainly a third party), but that isn't mentioned in the 
spec.

I suggest adding a non-normative note that:

1. describes the reasons of this architectural decision (the privacy concern),
2. describes a possible work-around (xhr request to App Server to get the data),
3. eventually mentions some of the benefits (e.g. payload can be always up to 
date even if notification is stale).

Secondly, the very helpful sequence diagram contained in the spec could be 
amended like so (to hint at this work-around):

  ++   ++ ++   ++
  | webapp |   |  user  | |  push  |   |  app   |
  ||   | agent  | | server |   | server |
  ++   ++ ++   ++
  ||  | |
  |-register--|  | |
  ||  | |
  |  (user accepts)   | |
  ||  | |
  ||-setup push service-| |
  ||  | |
  |---success-|  | |
  ||  | |
  |--activate service with PushService attributes-|
  ||  | |
  ||  |--push notification-|
  ||  |   per service API   |
  ||  | |
  || (match to user agent)  |
  ||  | |
  ||--push notification--| |
  || per service protocol | |
  ||  | |
  |(match to webapp)  | |
  ||  | |
  |---system message--|  | |
  ||  | |
  |--XHR GET Request---|
  ||  | |
  |---Payload--|
  ||  | |

Best,

--tobie


[PUSH API] Request for CFC on publication of new WD

2013-07-11 Thread SULLIVAN, BRYAN L
Hi Webapps,

Eduardo and I have uploaded a new ED of the Push API at 
https://dvcs.w3.org/hg/push/raw-file/tip/index.html.

This incorporates a variety of changes based upon comments received since the 
last ED. See https://github.com/telefonicaid/WebAPISpecs/commits/develop/Push 
for details on these changes:

* Correct issues with Pubrules Checker

* moving push notification steps to system messages section

* escaping character

* Push server *may* skip version notifications ...

* if none, registrations() returns 0 length array ...

* Complete example code ...

* Replace references to web intents with push service extension ...

* editorial correction

* renaming appToken to pushRegistrationId

* splitting pushEndpoint into pushEndpoint and appToken

* adding links to promises algorithms

* fixing Promise-related descriptions

* fix example 1 to use Promise

* addressing Jonas' concern about transfering actual content in 
notific... ...

* removing serverProtocols

* changing version to unsigned long long and clarifying when it is 
null... ...

* changing from DOMRequest to Promise

* Add bit about semantics of push notification delivery guarantees

We would like to request a CFC for publication of a new WD based upon this ED.

Thanks,
Bryan Sullivan



RE: Files on IndexedDB

2013-06-11 Thread SULLIVAN, BRYAN L
Comments below.

-Original Message-
From: Jonas Sicking [mailto:jo...@sicking.cc] 
Sent: Wednesday, June 12, 2013 8:56 AM
To: Arthur Barstow
Cc: pira...@gmail.com; Webapps WG
Subject: Re: Files on IndexedDB

Hi Art,

Actually, the response in [2] says that we should clarify in the spec
that files, blobs and filelists are stored by value rather than by
reference. This is not a normative change since the spec already
defines this behavior. However the behavior is defined somewhat
indirectly which means that it'd make sense to clarify it explicitly.

/ Jonas

bryan It's still not clear to me why you say that File blobs (blobs as 
extended by the File API) are stored by value. The current working 
implementation across multiple shipping browsers would say that File objects 
are not stored by value, but that when read (as in 8.5.4. The readAsText(blob, 
label) method) the current filesystem data is read, not a stored copy. Perhaps 
I'm misunderstanding the intent of this proposed change, and it would not 
actually change current implementations. But the section 8.5.4 is pretty 
clearly (to me) referring to an operation that reads data from the underlying 
filesystem, e.g. While processing the read, as data from the blob becomes 
available... indicating that there is a process of reading from some storage. 
It would not make sense for example if I have a 1GB file that I want my app to 
read, that the browser has to make *two* copies of it - one in some 
browser-temporary/hidden filesystem location (as a copy of the original file) 
and the second, in-memory copy. It would be much more straightforward, and 
support the existing UX, if the browser reads the current filesystem version 
when readAs... methods are called.

Thanks,
Bryan Sullivan 

On Tue, Jun 11, 2013 at 11:24 AM, Arthur Barstow art.bars...@nokia.com wrote:
 Hi - your comment is considered a Last Call comment and it was included in
 the LC's comment tracking document [1].

 In [2], Joshua proposed this comment be addressed/resolved as a feature
 request and as such, it was added to the IDB feature request list [3].

 For the purposes of tracking your comment, please indicate if this
 resolution is acceptable or not.

 -Thanks, ArtB

 [1]
 https://dvcs.w3.org/hg/IndexedDB/raw-file/default/Comments-16-May-2013-LCWD.html
 [2]
 http://lists.w3.org/Archives/Public/public-webapps/2013AprJun/0817.html
 [3] http://www.w3.org/2008/webapps/wiki/IndexedDatabaseFeatures



 On 5/30/13 5:24 AM, ext pira...@gmail.com wrote:


 According to IndexedDB specification, File and Blob and FileList objects
 should be allowed to be stored inside IndexedDB doing a shallow copy. On
 Mozilla this is possible, although File and Blob objects are stored
 nativelly on a special place on the hard disk. Chrome is working on it at
 this moment. Problem is, seems they are being duplicated and a copy is
 stored instead of a reference to the original File. I think is not the
 correct way to do it... or at least not always.

 File and FileList objects are only available from Input tags (at this
 moment you can't be able to create them by hand, and also can't be
 downloaded, only Blob objects), so they exists on the user hard disk, so
 it's not necesary to make a duplicate and waste space. It would make sense
 to store a copy inside IndexedDB when you want to store it, but if you want
 to store only some metadata for the File object (for example a hash of the
 file, or a flag for already viewed chapters on a local hard disk stored
 serie) making a copy is useless.

 Also, although is being currently discused, FileList objects are suposed
 to be live objects showing the current status of a directory each time is
 readed (both added, updated and removed File objects), and File objects
 should work the same, working mainly as references to the hard disk status
 that would not be the actual one if they are stored duplicates on the
 database (they will show the status when the File / FileList was stored),
 and specially when the IndexedDB is accessed between reloads.

 On the other hand, Blob objects can be created and downloaded, so it makes
 sense to store duplicates of data that's currently on RAM and would
 disappear after a page reload, in the same way you save your work before
 closing an application.

 So my proposition is about to allow the File and FileList objects being
 stored as actual references to the original hard disk File and FileList
 objects instead of data duplicates, and only store really inside IndexedDB
 data from Blob objects. This way would allow to store references to opened
 File and FileList objects between reloads of the page without requiring to
 the user to re-select them and process them again as new, while allowing to
 store data (also File objects) inside IndexedDB in the form of Blob objects.







RE: Files on IndexedDB

2013-06-11 Thread SULLIVAN, BRYAN L
Update: my comments were referring to the File API, not the IndexedDB API - I 
mistook the context of this thread (somehow) to be about the File API... 
nevermind!

-Original Message-
From: SULLIVAN, BRYAN L 
Sent: Wednesday, June 12, 2013 11:18 AM
To: Jonas Sicking; Arthur Barstow
Cc: pira...@gmail.com; Webapps WG
Subject: RE: Files on IndexedDB

Comments below.

-Original Message-
From: Jonas Sicking [mailto:jo...@sicking.cc] 
Sent: Wednesday, June 12, 2013 8:56 AM
To: Arthur Barstow
Cc: pira...@gmail.com; Webapps WG
Subject: Re: Files on IndexedDB

Hi Art,

Actually, the response in [2] says that we should clarify in the spec
that files, blobs and filelists are stored by value rather than by
reference. This is not a normative change since the spec already
defines this behavior. However the behavior is defined somewhat
indirectly which means that it'd make sense to clarify it explicitly.

/ Jonas

bryan It's still not clear to me why you say that File blobs (blobs as 
extended by the File API) are stored by value. The current working 
implementation across multiple shipping browsers would say that File objects 
are not stored by value, but that when read (as in 8.5.4. The readAsText(blob, 
label) method) the current filesystem data is read, not a stored copy. Perhaps 
I'm misunderstanding the intent of this proposed change, and it would not 
actually change current implementations. But the section 8.5.4 is pretty 
clearly (to me) referring to an operation that reads data from the underlying 
filesystem, e.g. While processing the read, as data from the blob becomes 
available... indicating that there is a process of reading from some storage. 
It would not make sense for example if I have a 1GB file that I want my app to 
read, that the browser has to make *two* copies of it - one in some 
browser-temporary/hidden filesystem location (as a copy of the original file) 
and the second, in-memory copy. It would be much more straightforward, and 
support the existing UX, if the browser reads the current filesystem version 
when readAs... methods are called.

Thanks,
Bryan Sullivan 

On Tue, Jun 11, 2013 at 11:24 AM, Arthur Barstow art.bars...@nokia.com wrote:
 Hi - your comment is considered a Last Call comment and it was included in
 the LC's comment tracking document [1].

 In [2], Joshua proposed this comment be addressed/resolved as a feature
 request and as such, it was added to the IDB feature request list [3].

 For the purposes of tracking your comment, please indicate if this
 resolution is acceptable or not.

 -Thanks, ArtB

 [1]
 https://dvcs.w3.org/hg/IndexedDB/raw-file/default/Comments-16-May-2013-LCWD.html
 [2]
 http://lists.w3.org/Archives/Public/public-webapps/2013AprJun/0817.html
 [3] http://www.w3.org/2008/webapps/wiki/IndexedDatabaseFeatures



 On 5/30/13 5:24 AM, ext pira...@gmail.com wrote:


 According to IndexedDB specification, File and Blob and FileList objects
 should be allowed to be stored inside IndexedDB doing a shallow copy. On
 Mozilla this is possible, although File and Blob objects are stored
 nativelly on a special place on the hard disk. Chrome is working on it at
 this moment. Problem is, seems they are being duplicated and a copy is
 stored instead of a reference to the original File. I think is not the
 correct way to do it... or at least not always.

 File and FileList objects are only available from Input tags (at this
 moment you can't be able to create them by hand, and also can't be
 downloaded, only Blob objects), so they exists on the user hard disk, so
 it's not necesary to make a duplicate and waste space. It would make sense
 to store a copy inside IndexedDB when you want to store it, but if you want
 to store only some metadata for the File object (for example a hash of the
 file, or a flag for already viewed chapters on a local hard disk stored
 serie) making a copy is useless.

 Also, although is being currently discused, FileList objects are suposed
 to be live objects showing the current status of a directory each time is
 readed (both added, updated and removed File objects), and File objects
 should work the same, working mainly as references to the hard disk status
 that would not be the actual one if they are stored duplicates on the
 database (they will show the status when the File / FileList was stored),
 and specially when the IndexedDB is accessed between reloads.

 On the other hand, Blob objects can be created and downloaded, so it makes
 sense to store duplicates of data that's currently on RAM and would
 disappear after a page reload, in the same way you save your work before
 closing an application.

 So my proposition is about to allow the File and FileList objects being
 stored as actual references to the original hard disk File and FileList
 objects instead of data duplicates, and only store really inside IndexedDB
 data from Blob objects. This way would allow to store references to opened
 File and FileList objects

RE: [PUSH API] Scope of the specification

2013-06-03 Thread SULLIVAN, BRYAN L
Thanks for starting this thread, Arnaud. I have some responses below, and look 
forward to discussions on these topics.

Bryan Sullivan 

-Original Message-
From: arnaud.br...@orange.com [mailto:arnaud.br...@orange.com] 
Sent: Monday, June 03, 2013 9:05 AM
To: public-webapps@w3.org
Subject: [PUSH API] Scope of the specification

Greetings,

During the last face to face we had a start of a discussion on what should fall 
within the scope of the PUSH specification. I feel we should go a little 
further on this matter. 

As it is designed right now the whole system requires 3 APIs :
- one between the web application and the browser (the core of this spec)
- one between the push server and the application server 
- one between the push server and the device.

During the face to face I think we agreed that the first two at the very least 
should fall within the scope of the spec, do we feel the third one is trivial 
enough to not require any sort of specification ? 

bryan One key current rationale for leaving this out of scope was not its 
triviality, but rather to be opaque to the different protocols that 
implementations may use between their push server and client, or even different 
bearers (OMA Push for example is spec'd for use across SMS, UDP, TCP, HTTP, 
SIP, and multicast/broadcast bearers - but usually the actual used bearer is 
abstracted from the target application, being a function of a push client on 
device which exposes an API to the applications, e.g. Android's broadcast 
events for WAP Push).

There are other parts that I also feel would require some attention:
- How the push server is discovered and selected (currently the spec speaks of 
an intent server but with intent currently being shelved I am unsure whether 
this is the right path to take. Also it seemed to me that the user journey on 
proxy selection was rather different than the one imagined for web intents).

bryan Service discovery and selection are things that we still need to 
address, and the UI-related obstacles that the browser vendors have reported 
with their Web Intents implementation experiments should not prevent us from 
continuing discussion on these important facets of the web architecture. I 
don't think however that this should be a normative dependency upon the Push 
API as a UA/app interface, but rather a separate spec. That separate spec may 
be useful in establishing a pattern for service discovery and selection that is 
useful for other APIs, e.g. payment, and the actions earlier envisioned for Web 
Intents.

- How a given application registers on the push server and how the push server 
may or may not allow access to its push service (I guess this falls within some 
of the security remarks and the general security model of the solution).

bryan Registration today is a largely manual process of establishing a 
developer relationship with a push service provider. The TOCs for push server 
API use are also service-specific. Going beyond that to enable dynamic 
registration and TOC/policy management is a more ambitious goal, and could be a 
part of the 2nd spec mentioned above, but discovery/selection is likely to be 
an easier thing to spec in the short term.

- How the push server should be designed (I think we agreed that writing some 
informational guidelines that would be non normative would be a good idea).

bryan I agree that operating store-and-forward messaging systems (push being 
one type) or even simple pass-thru push gateways can be complex. We can 
contribute to these guidelines based upon what we have spec'd (going back to 
pre-2000) in WAP Forum / OMA, and learned through operating push services for 
more than 10 years.

//Arnaud

_

Ce message et ses pieces jointes peuvent contenir des informations 
confidentielles ou privilegiees et ne doivent donc
pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce 
message par erreur, veuillez le signaler
a l'expediteur et le detruire ainsi que les pieces jointes. Les messages 
electroniques etant susceptibles d'alteration,
France Telecom - Orange decline toute responsabilite si ce message a ete 
altere, deforme ou falsifie. Merci.

This message and its attachments may contain confidential or privileged 
information that may be protected by law;
they should not be distributed, used or copied without authorisation.
If you have received this email in error, please notify the sender and delete 
this message and its attachments.
As emails may be altered, France Telecom - Orange is not liable for messages 
that have been modified, changed or falsified.
Thank you.





RE: Filesystem events

2013-05-29 Thread SULLIVAN, BRYAN L
From: Charles Pritchard [mailto:ch...@jumis.com]
Sent: Wednesday, May 29, 2013 3:08 PM
To: pira...@gmail.com
Cc: public-webapps@w3.org
Subject: Re: Filesystem events

We didn't come to much of a resolution.
It was suggested that the current behavior in browsers was incorrect; that the 
File should become inaccessible if/when it changes.

bryan I disagree, the fact that re-accessing a file object loads the latest 
version of the file is a valuable feature IMO, even if it was not intentional. 
I don't know if preventing that is what you meant, but further to require that 
the user reselect a file if it has changed would be a UX killer.

Thanks,
Bryan Sullivan



RE: Filesystem events

2013-05-29 Thread SULLIVAN, BRYAN L
-Original Message-
From: Jonas Sicking [mailto:jo...@sicking.cc] 
Sent: Wednesday, May 29, 2013 3:25 PM
To: SULLIVAN, BRYAN L
Cc: Charles Pritchard; pira...@gmail.com; public-webapps@w3.org
Subject: Re: Filesystem events

On Wed, May 29, 2013 at 3:17 PM, SULLIVAN, BRYAN L bs3...@att.com wrote:
 From: Charles Pritchard [mailto:ch...@jumis.com]
 Sent: Wednesday, May 29, 2013 3:08 PM
 To: pira...@gmail.com
 Cc: public-webapps@w3.org
 Subject: Re: Filesystem events



 We didn't come to much of a resolution.
 It was suggested that the current behavior in browsers was incorrect; that
 the File should become inaccessible if/when it changes.

 bryan I disagree, the fact that re-accessing a file object loads the
 latest version of the file is a valuable feature IMO, even if it was not
 intentional. I don't know if preventing that is what you meant, but further
 to require that the user reselect a file if it has changed would be a UX
 killer.

File objects should be immutable. That was one of the core design
principles that they were built around.

If we want input type=file to provide live access to on-disk
files, then new File objects should be returned from
HTMLInputElement.files whenever the on-disk files change. That would
need to be defined by the HTML spec though.

bryan OK, but that sounds like one of those good UA design principles that 
ignores the actual effect upon apps and users. I would prefer to keep this 
bug around until the new/better design is implemented.



RE: Filesystem events

2013-05-29 Thread SULLIVAN, BRYAN L
-Original Message-
From: Jonas Sicking [mailto:jo...@sicking.cc] 
Sent: Wednesday, May 29, 2013 3:44 PM
To: SULLIVAN, BRYAN L
Cc: Charles Pritchard; pira...@gmail.com; public-webapps@w3.org
Subject: Re: Filesystem events

On Wed, May 29, 2013 at 3:34 PM, SULLIVAN, BRYAN L bs3...@att.com wrote:
 -Original Message-
 From: Jonas Sicking [mailto:jo...@sicking.cc]
 Sent: Wednesday, May 29, 2013 3:25 PM
 To: SULLIVAN, BRYAN L
 Cc: Charles Pritchard; pira...@gmail.com; public-webapps@w3.org
 Subject: Re: Filesystem events

 On Wed, May 29, 2013 at 3:17 PM, SULLIVAN, BRYAN L bs3...@att.com wrote:
 From: Charles Pritchard [mailto:ch...@jumis.com]
 Sent: Wednesday, May 29, 2013 3:08 PM
 To: pira...@gmail.com
 Cc: public-webapps@w3.org
 Subject: Re: Filesystem events



 We didn't come to much of a resolution.
 It was suggested that the current behavior in browsers was incorrect; that
 the File should become inaccessible if/when it changes.

 bryan I disagree, the fact that re-accessing a file object loads the
 latest version of the file is a valuable feature IMO, even if it was not
 intentional. I don't know if preventing that is what you meant, but further
 to require that the user reselect a file if it has changed would be a UX
 killer.

 File objects should be immutable. That was one of the core design
 principles that they were built around.

 If we want input type=file to provide live access to on-disk
 files, then new File objects should be returned from
 HTMLInputElement.files whenever the on-disk files change. That would
 need to be defined by the HTML spec though.

 bryan OK, but that sounds like one of those good UA design principles 
 that ignores the actual effect upon apps and users. I would prefer to keep 
 this bug around until the new/better design is implemented.

I would expect that this doesn't work in most current UAs. Most UAs
likely cache the size of the File inside the File object, and so even
if the file changes on disk you can't see the new size, and possibly
can't read past the cached size.

bryan Last time I tested it, it did work (and that was my reading of the 
spec, at least it did not prohibit the expected behavior I read), but to be 
sure, I retested: as of the current version of Firefox and Chrome, it is 
possible to reload a file with the latest content, without bringing up the file 
requester again. That's the UX I am talking about, if I misunderstood the 
meaning of this discussion. My test is at 
http://bkaj.net/test/webapi/file-api.html.  



RE: CfC - working on manifest

2013-05-14 Thread SULLIVAN, BRYAN L
Chaals,

Overall, I think we support this proposal but have some questions I would like 
to get clarifications on:

Maybe I don't recall but is SysApps asking Webapps to take the manifest aspect? 
Or is this something Webapps thinks is its right because of the prior focus on 
Widgets packaging? I don't recall  case of a group unilaterally taking back 
something similar to something else it had worked on in the past.

If SysApps did approve but in the end disapproved with the result, what 
recourse would they have? Woudnt it be better to have this as a joint 
deliverable then?

Thanks,
Bryan Sullivan 

-Original Message-
From: Charles McCathie Nevile [mailto:cha...@yandex-team.ru] 
Sent: Tuesday, May 14, 2013 6:29 AM
To: public-webapps WG
Subject: CfC - working on manifest

Hi,

at the face to face meeting we agreed to take back the work on a manifest  
specification for apps, based on the current manifest draft from sysapps  
[1] that was developed from the proposal [2] included in our charter [3],  
and to leave the runtime part of the work with Sysapps.

This is a formal Call for Consensus on that resolution. Silence will be  
taken as assent. Responses will be accepted up to the end of the day  
Tuesday 21 May.

for the chairs
Chaals

[1] http://manifest.sysapps.org/
[2] http: 404 (and people ask me why I care where things get published)
[3] http://www.w3.org/2012/webapps/charter/Overview.html

-- 
Charles McCathie Nevile - Consultant (web standards) CTO Office, Yandex
   cha...@yandex-team.ru Find more at http://yandex.com



RE: CfC - working on manifest

2013-05-14 Thread SULLIVAN, BRYAN L
Thanks for the clarifications - we support it.
And I will try to do less multitasking at F2F's!

Thanks,
Bryan Sullivan 

-Original Message-
From: Charles McCathie Nevile [mailto:cha...@yandex-team.ru] 
Sent: Tuesday, May 14, 2013 7:47 AM
To: public-webapps WG; SULLIVAN, BRYAN L
Subject: Re: CfC - working on manifest

On Tue, 14 May 2013 18:39:34 +0400, SULLIVAN, BRYAN L bs3...@att.com  
wrote:

 Chaals,

 Overall, I think we support this proposal but have some questions I  
 would like to get clarifications on:

Minutes of the discussion, to help jog your memory:  
http://www.w3.org/2013/04/25-webapps-minutes.html#item04 (I apoogise for  
not linking those from the original CfC message).

 Maybe I don't recall but is SysApps asking Webapps to take the manifest  
 aspect?

Yes.

 Or is this something Webapps thinks is its right because of the prior  
 focus on Widgets packaging? I don't recall  case of a group unilaterally  
 taking back something similar to something else it had worked on in the  
 past.

No, the idea is that we all agree on this.

 If SysApps did approve but in the end disapproved with the result, what  
 recourse would they have?

Comment on the spec and say that's terrible, it should be If  
necessary as formal objections to moving forward. As a practical matter I  
think nearly all of sysapps members are also represented in webapps. So I  
would be surprised if there were a real issue.

 Woudnt it be better to have this as a joint deliverable then?

No, there is a handful of frustrating overhead to do that which, if it is  
as unnecessary as it seems in this case, the people who would have to deal  
with it (chairs, editors, staff contacts) preferred to avoid.

 Thanks,
 Bryan Sullivan

 -Original Message-
 From: Charles McCathie Nevile [mailto:cha...@yandex-team.ru]
 Sent: Tuesday, May 14, 2013 6:29 AM
 To: public-webapps WG
 Subject: CfC - working on manifest

 Hi,

 at the face to face meeting we agreed to take back the work on a manifest
 specification for apps, based on the current manifest draft from sysapps
 [1] that was developed from the proposal [2] included in our charter [3],
 and to leave the runtime part of the work with Sysapps.

 This is a formal Call for Consensus on that resolution. Silence will be
 taken as assent. Responses will be accepted up to the end of the day
 Tuesday 21 May.

 for the chairs
 Chaals

 [1] http://manifest.sysapps.org/
 [2] http: 404 (and people ask me why I care where things get published)
 [3] http://www.w3.org/2012/webapps/charter/Overview.html



-- 
Charles McCathie Nevile - Consultant (web standards) CTO Office, Yandex
   cha...@yandex-team.ru Find more at http://yandex.com


RE: [IndexedDB] How to recover data from IndexedDB if the origin domain don't exist anymore?

2013-01-09 Thread SULLIVAN, BRYAN L
Perhaps this problem indicates a real limitation in the same-origin policy as 
root for browser data. In a somewhat related point at TPAC for example I 
pointed out that the value of using IndexedDB for media storage - e.g. GBs of 
music or videos - will be severely limited if I can't switch my web-based media 
player application from one origin to another.

Perhaps what we need (and I am ducking as I say this) is a meta tag for web 
pages, e.g.
meta name=previously-known-as content=http://olddomain.com:80;
or
meta name=same-as content=http://olddomain.com:80;

This could then be used by the browser to allow the user (always in control of 
such decisions) to grant the new origin to take ownership of (or at least gain 
read/write access to) any existing data of the old origin.

Thanks,
Bryan Sullivan

From: pira...@gmail.com [mailto:pira...@gmail.com]
Sent: Tuesday, January 08, 2013 11:37 AM
To: Todd Blanchard
Cc: public-webapps@w3.org
Subject: Re: [IndexedDB] How to recover data from IndexedDB if the origin 
domain don't exist anymore?

Hacky, but nice trick (really, I like it :-) ). My question was more related 
about looking for a solution available for non-techies users, or give a warning 
about a (valid?) corner-case on the specification.

(I'm going to add an issue on my project tracker to remind me to develop your 
idea, it's really simple and useful :-) )

2013/1/8 Todd Blanchard 
toddvblanch...@gmail.commailto:toddvblanch...@gmail.com
As a practical matter, you could just make an entry in your /etc/hosts mapping 
the domain to localhost and write a web page that dumps the indexeddb as json.  
Serve that from your local web server and hit it with your browser.


On Jan 8, 2013, at 7:08 AM, pira...@gmail.commailto:pira...@gmail.com wrote:


I have been looking on Internet and reading the spec but didn't be able to get 
at answer.

Let's see the next situation: I've developed a webapp that use IndexedDB to 
store personal data. It's pure client-side and server-less, being all the 
content of the webapp just static files and served with static web servers and 
CDNs, so all the user data is stored on IndexedDB on the user's computer and 
not any other place (there's no a database server that could be accesed in 
any form in any place at all).

I know that IndexedDB use a same-domain policy to isolate the access to the 
data, but maybe one day the domain of my webapp could dissapear for any reason 
(bankrupcy, forgot to pay the domain renoval, legal issues, system fail... 
whatever) so I can't be able to access to the page to download the webapp that 
would allow to me to access to MY data in MY computer.

At this moment, I've developed a way to make backups of the content of the 
IndexedDB so it could be imported on the IndexedDB of other domain (and also 
on other computer if neccessary) but I find it bad for usability, so my 
question is, there's a way so an IndexedDB database could be shared by several 
domain unrelated webapps? Maybe defining in some way a fake origin for the 
IndexedDB object that all the webapps could have in common (in some way like a 
magic word), or the specification doesn't allow this possiblity at this 
moment? If so, how I could be able to do it?

Greetings and thank you very much, Jesús Leganés Combarro.

Jesús Leganés Combarro
pira...@gmail.commailto:pira...@gmail.com
http://github.com/piranna/ShareIt


--
Si quieres viajar alrededor del mundo y ser invitado a hablar en un monton de 
sitios diferentes, simplemente escribe un sistema operativo Unix.
- Linus Tordvals, creador del sistema operativo Linux




--
Si quieres viajar alrededor del mundo y ser invitado a hablar en un monton de 
sitios diferentes, simplemente escribe un sistema operativo Unix.
- Linus Tordvals, creador del sistema operativo Linux


RE: FileSystem compromise spec

2012-11-30 Thread SULLIVAN, BRYAN L
 -Original Message-
 From: Arthur Barstow [mailto:art.bars...@nokia.com]
 Sent: Friday, November 30, 2012 6:46 AM
 To: ext Eric U; Doug Schepers
 Cc: Web Applications Working Group WG
 Subject: Re: FileSystem compromise spec
 
 On 11/15/12 7:39 PM, ext Eric U wrote:
  As discussed at TPAC, there's little support for the current FileSystem 
  API, but
  some support for a new API, and I promised to put forth a compromise 
  proposal.
  In order to do that, I'd like to hear 1) what kinds of changes would make it
  more popular; 2) who I'm trying to convince.  There are a number of folks 
  who
  have said that they're not interested in a FileSystem API at all, so I'd 
  rather
  concentrate my efforts on those with skin in the game.
 

Note that even though we are a service provider and not a browser vendor, I do 
consider us to have skin in the game.

 * It's designed to handle both the sandbox and the
   outside-the-sandbox use cases.  For folks interested in just the 
  sandbox and
   no future expansions, that seems like wasted effort, and a 
  sandbox-only API
   could be simpler.  It's not clear to me that there is anyone 
  interested in
   just the sandbox and no future expansions, but if there is, please 
  speak up.
   I've certainly heard from folks with the opposite goal.

I am still looking for evidence that IndexedDB provides a high-performance, 
scalable, cross-domain alternative to native filesystem access. I've seen 
conflicting information on that, and will gather this information with whatever 
tests can be found to validate performance of browsers for IndexedDB.

 It seems like it would be useful to look at these various file and
 database specs from a high level use case perspective (f.ex. one way to
 address UC X is to use spec X). If anyone is aware of some related
 docs, please let me know. Doug - wondering aloud here if this is
 something webplatform.org might cover or if you know of someone that
 might be interested in creating this type of documentation?

In the Web  TV IG I will be leading a task force specifically to address the 
recording and storage of media use cases, where storage options are the key 
focus. If someone can prove to us that in-the-sandbox storage addresses the 
needs (high-performance, scalable, cross-domain) then great; otherwise we will 
keep looking.

 
  I'd like to hear from folks who are interested, but not in the current spec.
 

I note that this request seems to exclude (or recommend silence) of 
counter-points from those that *want the current specs* as mentioned by Eric. 
So if there is a lack of contribution from those that support the other use 
cases noted (e.g. out-of-the-sandbox storage), it should not be taken as 
consensus with the alternative as discussed in this thread.

Thanks,
Bryan Sullivan



RE: CfC: publish FPWD of Push API; deadline October 12

2012-10-15 Thread SULLIVAN, BRYAN L
Hi Art,

An issue has been added as requested in the current draft [1].

[1] http://dvcs.w3.org/hg/push/raw-file/default/index.html

Thanks,
Bryan Sullivan 

 -Original Message-
 From: Arthur Barstow [mailto:art.bars...@nokia.com]
 Sent: Monday, October 15, 2012 4:15 AM
 To: public-weba...@w3c.org; SULLIVAN, BRYAN L; EDUARDO FULLEA CARRERA
 Subject: Re: CfC: publish FPWD of Push API; deadline October 12
 
 On 10/5/12 7:38 AM, ext Arthur Barstow wrote:
  The Push API Editors would like to publish a First Public Working
  Draft of their spec and this is a Call for Consensus to do so, using
  the following spec as the basis
  http://dvcs.w3.org/hg/push/raw-file/default/index.html.
 
  This CfC satisfies the group's requirement to record the group's
  decision to request advancement.
 
  By publishing this FPWD, the group sends a signal to the community to
  begin reviewing the document. The FPWD reflects where the group is on
  this spec at the time of publication; it does _not_ necessarily mean
  there is consensus on the spec's contents.
 
  If you have any comments or concerns about this CfC, please reply to
  this e-mail by October 12 at the latest. Positive response is
  preferred and encouraged and silence will be considered as agreement
  with the proposal.
 
 Although there were no objections to this CfC, Jonas raised a number of
 concerns in
 http://lists.w3.org/Archives/Public/public-
 webapps/2012OctDec/0042.html.
 Although we will have an opportunity to discuss these comments in Lyon,
 I would like the spec Editors to add an Issue Block in the Security
 and Privacy concerns section and include a link to Jonas' comment.
 
 Bryan, Eduardo - I will contact you off-list about preparing the spec
 for FPWD. (See http://www.w3.org/wiki/Webapps/SpecEditing if you are
 unfamiliar with the W3C's TR publication process.)
 
 -Thanks, AB
 
 
 




RE: Moving File API: Directories and System API to Note track?

2012-10-04 Thread SULLIVAN, BRYAN L
 -Original Message-
 From: Olli Pettay [mailto:olli.pet...@helsinki.fi]
 Sent: Thursday, October 04, 2012 3:48 AM
 To: SULLIVAN, BRYAN L
 Cc: Maciej Stachowiak; Glenn Maynard; Eric U; public-webapps@w3.org
 Subject: Re: Moving File API: Directories and System API to Note track?
 
 On 09/26/2012 01:32 AM, SULLIVAN, BRYAN L wrote:
  *From:*Maciej Stachowiak [mailto:m...@apple.com]
  *Sent:* Tuesday, September 25, 2012 2:59 PM
  *To:* Glenn Maynard
  *Cc:* Eric U; o...@pettay.fi; public-webapps@w3.org
  *Subject:* Re: Moving File API: Directories and System API to Note
 track?
 
  Hi Glenn,
 
  I read over your points. But I don't think they would change Apple's
 calculation about exposing an API to the real user filesystem in Safari,
  particularly as specified. I do think that my more minimal API might
 also be a better fit for the real filesystem use case, as it removes a
 bunch of
  unnecessary levels of indirection and abstraction that exist in the
 other proposals. But I think it is unlikely we would expose that aspect.
 
  We are still open to solving the sandboxed local storage area use
 case, with a more minimal API. But first we'd like to understand why
 those use
  cases can't be solved with targeted additions to IndexedDB (see forked
 thread).
 
  Can IndexedDB support the use case of managing a media or document
 library on the local device, in which the size of library can run into
 hundreds or
  files and gigabytes of storage?
 I don't see any technical problems with that.
 
Other than hard limits on storage per origin and how the virtual filesystem 
would be organized and managed, neither do I, but I am not an expert in browser 
design, that's why I asked the question. If there are no technical problems, 
anyone have thoughts on how soon we can expect to see browsers that provide a 
virtual filesystem implementation based upon Indexed DB?

 
  Local storage of media is one of the key capabilities needed to enable
 HTML5-based offline media players as a
  realistic option. If the browser can effectively provide a virtual
 filesystem with performance characteristics equivalent to the underlying
 OS, then
  perhaps IndexedDB may suffice for filesystem access. But which
 browsers intend to support that level of functionality via IndexexDB?
 
 Isn't that part of IndexedDB, to be able to store files efficiently in
 it. So I would assume all the implementations will
 support that.

I don't think specific efficiency objectives are a normative requirement of 
Indexed DB, but the question was more whether browser vendors would claim that 
their Indexed DB implementation will provide performance equivalent to the 
underlying OS. Apart from the technical challenges, it's unrealistic to use 
Indexed DB for this purpose if the performance cannot match the underlying OS.



RE: [admin] Publishing specs before TPAC: CfC start deadline is Oct 15

2012-09-26 Thread SULLIVAN, BRYAN L
Hi Art,

We've previously called for any comments to the current Push API draft [1], and 
would like to promote it to FPWD before TPAC. We haven't received any 
substantive comments as far as I know, which tells me that it could be in good 
shape for publication. With the addition of Telefonica (Eduardo) as co-editor 
and simplification / better alignment with proposals for B2G / Firefox OS, I 
believe we are in shape for FPWD now. So if I could request a CFC for 
publication as FPWD before Oct 15, that would be our preference.

Alternatively we can put this on the agenda for TPAC and discuss/promote it 
then as possible. But in the absence of substantive comments (which tells me we 
have addressed most of the comments on the first ED), I think we should be 
ready for FPWD.

[1] http://dvcs.w3.org/hg/push/raw-file/default/index.html

Thanks,
Bryan Sullivan 

 -Original Message-
 From: Arthur Barstow [mailto:art.bars...@nokia.com]
 Sent: Wednesday, September 26, 2012 7:27 AM
 To: public-weba...@w3c.org
 Subject: [admin] Publishing specs before TPAC: CfC start deadline is Oct
 15
 
 The upcoming TPAC meeting week (Oct 29-Nov2) provides an opportunity for
 joint WG meetings and lots of informal information sharing. As such, it
 can be useful to make new publications before TPAC.
 
 There is a publication blackout period around TPAC and Oct 23 is the
 last day to request publication before TPAC. Given our 1-week CfC for
 new publications, weekends, etc., Oct 15 is the last day to start a CfC
 to publish a document before TPAC. However, a lot of groups publish
 documents at this time so starting the CfC earlier is highly
 recommended.
 
 Scanning [PubStatus], here are some potential candidates to publish
 before TPAC. It would be good to re-publish our newer specs, especially
 if the spec has had some relatively significant changes (since FPWD)
 and/or it is getting some implementation/deployment:
 
 * File API - Arun can you get this spec ready for LC by October 15?
 
 * Gamepad - Scott, Ted - what's the status of the spec and its
 implementation?
 
 * Indexed Database API - Jonas, Eliot - what's the status of LC#1
 comment processing? Is a new LC going to be necessary?
 
 * Pointer Lock - Vincent - what's the status of the spec and its
 implementation?
 
 * Screen Orientation - Mounir - what's the status of the spec and its
 implementation?
 
 * Server-sent Events - Hixie - can you give a rough guestimate on when
 bugs 15495 and 18796 will be fixed? (It looks to me like those are the
 only two bugs blocking CR.)
 
 If any other Editors want to publish a spec before TPAC, that would be
 great so please let us know and I'll start a CfC to publish.
 
 -Thanks, AB
 
 [PubStatus] http://www.w3.org/2008/webapps/wiki/PubStatus
 




RE: [push-api] Moving Push API to FPWD [Was: Re: [admin] Publishing specs before TPAC: CfC start deadline is Oct 15]

2012-09-26 Thread SULLIVAN, BRYAN L
Thanks for the feedback, Art. I've responded below. I will work on a new draft 
to address as many of your comments as I can.

Thanks,
Bryan Sullivan | Service Standards | ATT
+1-425-580-6514

 -Original Message-
 From: Arthur Barstow [mailto:art.bars...@nokia.com]
 Sent: Wednesday, September 26, 2012 11:59 AM
 To: SULLIVAN, BRYAN L
 Cc: public-weba...@w3c.org
 Subject: [push-api] Moving Push API to FPWD [Was: Re: [admin] Publishing
 specs before TPAC: CfC start deadline is Oct 15]
 
 On 9/26/12 1:49 PM, ext SULLIVAN, BRYAN L wrote:
  We've previously called for any comments to the current Push API draft
 [1], and would like to promote it to FPWD before TPAC. We haven't
 received any substantive comments as far as I know, which tells me that
 it could be in good shape for publication. With the addition of
 Telefonica (Eduardo) as co-editor and simplification / better alignment
 with proposals for B2G / Firefox OS, I believe we are in shape for FPWD
 now. So if I could request a CFC for publication as FPWD before Oct 15,
 that would be our preference.
 
  Alternatively we can put this on the agenda for TPAC and
 discuss/promote it then as possible. But in the absence of substantive
 comments (which tells me we have addressed most of the comments on the
 first ED), I think we should be ready for FPWD.
 
  [1] http://dvcs.w3.org/hg/push/raw-file/default/index.html
 
 The requirements for FPWD are relatively loose but because the
 publication of a FPWD starts a Call for (IP) Exclusions, it is helpful
 for some reviewers if the breath of the spec is mostly complete,
 although the depth can certainly be lacking.
 
 What is your view on the set of features/scope? Is the ED covering most
 of the scope? If there are any high priority features missing, what are
 they?
 

IMO the ED is covering the scope well. I don't think any high priority features 
are missing. We removed some of the earlier proposed features in the current 
draft.

 Based on a very quick scan, I noticed:
 
 * The Privacy and Security section is empty and I think it would be
 helpful if some additional informational was added before FPWD.
 

I have some text I can add for that.

 * The Specific Service Bindings section is empty. It seems like this
 should have some information before FPWD, especially if it is going to
 be a normative section. (Are some of these bindings specified outside
 the W3C?)
 

I think this was intended to be an informative section, unless at least one 
push service is proposed to be standardized. I can provide informative text for 
SMS, SIP, and OMA Push. Browser-specific push serices could also be included.

 * Push Framework - it appears this section should be marked as
 non-normative. I think it would be helpful if some type of flow diagram
 was included as well as example application code to use the API
 (although this non-normative info is not necessarily a blocker for
 FPWD).
 

Agreed, this should be informative.

 * serverProtocols - what are the expectations for the valid set of
 values; where are they specified?
 

Good question. We need some means of registration of well-known services so the 
protocols can be recognized.

 Some editorial comments ...
 
 * Define Web Intent Push Service provider, Push server and webapp
 or add a link to the definitions.
 

Will do.

 * Update the references that are out of date (e.g. HTML5).
 

Will do. This is respec.js magic.

 * Not clear what onopen event is since it isn't part of the PushService
 API
 

I think this may have been an omission, or we were thinking to use a listener 
for changes to the readyState as the open event. I will check with Eduardo on 
that.

 -Thanks, Art
 




Re: Push API draft update

2012-08-27 Thread SULLIVAN, BRYAN L
Hi Art,

Can you update the Webapps Publication Status page to add Eduardo as co-editor 
of the Push API draft?

We are looking forward to feedback on this update, with the goal of getting to 
FPWD by TPAC if possible.

Thanks,
Bryan Sullivan 
+

From: EDUARDO FULLEA CARRERA e...@tid.es 
Date: Wed, 22 Aug 2012 07:48:49 +0200
To: public-webapps (public-webapps@w3.org) public-webapps@w3.org 
Cc: bs3...@att.com bs3...@att.com 
Message-id: 492d97b30609c54fa9ff98b847ea5682b975989...@exclu2k7.hi.inet 
Hi all,

Bryan Sullivan and myself have been working together on updating the Push API 
draft based upon feedback received and the work being driven by Mozilla and 
Telefonica to build a Push solution for Firefox OS (B2G).

You can find it at: http://dvcs.w3.org/hg/push/raw-file/default/index.html


This update does not intend to address yet each and every comment received, as 
some may deserve further discussions, but we think is a good step forward. We 
are looking forward to receiving your feedback.

Thanks and regards,
Eduardo Fullea
Telefonica Digital


Este mensaje se dirige exclusivamente a su destinatario. Puede consultar 
nuestra política de envío y recepción de correo electrónico en el enlace 
situado más abajo.
This message is intended exclusively for its addressee. We only send and 
receive email on the basis of the terms set out at:
http://www.tid.es/ES/PAGINAS/disclaimer.aspx



RE: Push API draft uploaded

2012-06-06 Thread SULLIVAN, BRYAN L
Comment inline.

Thanks,
Bryan Sullivan 

-Original Message-
From: Tobie Langel [mailto:to...@fb.com] 
Sent: Tuesday, June 05, 2012 12:28 PM
To: Mounir Lamouri; public-webapps@w3.org
Subject: Re: Push API draft uploaded

On 6/5/12 4:00 PM, Mounir Lamouri mou...@lamouri.fr wrote:

On 05/31/2012 03:28 PM, Tobie Langel wrote:
 I'm probably missing something here, but notifications don't seem to be
 going through a system- / browser-wide notification panel from which the
 user can decide whether or not to navigate to an application. In other
 words, it looks like we're considering server -- app push
notifications,
 rather than server -- user push notifications.
 
 If that's case, how are we planning to handle waking up application A
 without disrupting the experience of the user currently busy using
 application B in the foreground (thinking essentially of mobile here)?
 
 Are we going to wake up application B but run it as a background app? If
 so, where is that behavior defined? Is that akin to a WebWorker or more
of
 a headless window? What's the life-cycle of such an app? Also, how can
 this app alert the user that it has something new for him? Do we also
have
 system level notifications in the work?
 
 If a given notification's sole purpose is to advise the user of some
 information he may or not want to act upon (e.g.: you have new mail),
 what are the benefits of waking up the application (or even spawning a
 worker) to do so? That seems like it would drain the battery of mobile
 devices for little purpose.
 
 Finally, aren't we conflating the notion of background work following a
 remote server or system event with that of push notification to the
user?
 
 An example of background work following a remote server event would be
the
 background update of daily news for a newspaper application. A remote
 server would send an event to the system / browser which itself would
 launch a WebWorker, that worker would perform the necessary io to upload
 the fresh content and save it in a db.

 An example of background work following a system event would be a
 location change event spawning a background worker which itself either
 stored the coordinates in a db or sent them to a remote server, e.g.
for a
 cycling app tracking your rides.
 
 Example of push notifications for the user are things like You've got a
 new message, It's Emma's birthday today, etc. The user can decide to
 act upon them (i.e. follow the provided link) or not, but until he does,
 there's no reason to launch an app or even a worker.
 
 Note that similar notifications would also need to be issued by
background
 workers / windows. E.g. The worker spawned above to upload fresh content
 for the newspaper app would be able to send a notification to the user
 when it's done (e.g. Today's news are  been downloaded.)
 
 Sorry if the above feels a bit like a brain dump. I'm really struggling
to
 understand the scope of this proposal. :-/

Actually, our System Message API [1] seems to answer most of those
questions: an application will be able to specify a worker or a page to
use when handling a message so it will be able to just run stuff in the
background and depending on what happened do something like show a
notification (via Desktop Notifications) or update a DB, or whatever.

[1]
https://groups.google.com/group/mozilla.dev.webapi/browse_thread/thread/a3
c6e4c31d04b663/

Thanks for the link!

While it's possible to display push notifications to the user via this
proposal (push notification spawns a worker which notifies the user via
Desktop Notification), on mobile it's probably a quantifiable waste of
battery life compared to push notifications that are directly aimed at the
user.

For applications built in a more traditional way (with server side
rendering, etc.), it still feels like providing the data in query params
should be investigated before it's dismissed.

Overall, I feel like writing down use cases and requirements would be
something useful to do at this point. What do you think?

bryan Here is the thread for the set of use cases I submitted for this API 
during the rechartering: 
http://lists.w3.org/Archives/Public/public-webapps/2012JanMar/0008.html. 
Additional use cases are welcome, and we can capture them and derived 
requirements on the Webapps wiki. I created a page for this: 
http://www.w3.org/2008/webapps/wiki/Push_API 

--tobie






RE: Push API draft uploaded

2012-06-01 Thread SULLIVAN, BRYAN L
Responses inline.

Thanks,
Bryan Sullivan 

-Original Message-
From: Tobie Langel [mailto:to...@fb.com] 
Sent: Thursday, May 31, 2012 6:29 AM
To: public-webapps@w3.org
Subject: Re: Push API draft uploaded

On 5/30/12 11:14 AM, Mounir Lamouri mou...@lamouri.fr wrote:

 * I guess the idea of |onmessage| is that the PushService instance will
 get an event when the backend will push a notification to the webapp.
 However, I wonder how you do handle the situation when the application
 is actually not being ran. Or should we wait for it to be launched?
 Anyhow, coupling the URL request and the event handling at the same
 place seems weird.

 bryan Not at all. This is the way that EventSource works for example
(the message handler is overtly associated with the request to a
specific service URL). I'm not sure what you mean by when the
application is actually not being ran... if you mean when the app is
not running, the answer is yes, the app should be started and the
event then delivered to it.
 
 Running a webapp/website then sending an event to it seems a rather hard
 task. This is actually what motivated the System Message Handler API.
 
 bryan I'm not sure how it's hard; the Webapp just arranges for Push
message delivery when it is invoked, and events are delivered to the
object that represents the service arrangement (whether connection-based
or connectionless or whatever). I may be missing your counterpoint.

I wasn't clear I think. If you start an application because of a
particular event, the application has no way to know it has been started
because of the event until the event is actually sent. But the event
will be sent at a point during load (or after) and in the meantime, the
application might show a UI as if it was simply started by the user. So
you might have a weird UI flickering where something will be shown and
very quickly will be changed to something else because of the push
notification coming.

Agreed with Mounir here. While passing an event to a running app makes
sense (and already exists in the form of EventSource) it really doesn't
for apps which are not running. Passing the event data as query params
seems more suitable in that case.

bryan If the event data can be passed through a fragment (e.g. there are no 
major limitations on that approach), and easily discovered/accessed by the app, 
then that would be a good approach. Can you provide an example of how that 
would work?

 * If we want want a |wakeup| attribute, this might need to live in the
 manifest as Jose suggested. In general, I wonder if that should be
 something the UA requests. I would understand why the UA would ignore
 |wakeup = true| but I wouldn't understand why it should always follows
 the passed value.

 bryan The wakeup feature might be turned on by the app through an
interface with the user, and used sometimes and others not per the
needs of the app and preferences of the user (app managed). If it's in
the manifest, it's fixed. I don't believe the UA should ignore the
requirements of the app, when the user has given their permission for
its operation as needed (both by browsing/installing the app, and
overtly by approving Push service use).
 
 I'm not sure I understand how the user would give its permission here.
 
 bryan By navigating to the Webapp (implicitly, in the case that the
Webapp had previously been permitted access to Push services by the
user), and by accepting the UA's prompt as to whether this app should be
allowed to receive Push messages the first time the user navigates to it
(explicitly).

So the user doesn't really give its permission to the app to wakeup the
device but to the app to be able to receive push notifications. Then,
the app is the only one deciding if it will wakeup the device or not.
I'm not a big fan of that approach but I don't really have a better idea
for the moment.

I'm probably missing something here, but notifications don't seem to be
going through a system- / browser-wide notification panel from which the
user can decide whether or not to navigate to an application. In other
words, it looks like we're considering server -- app push notifications,
rather than server -- user push notifications.

bryan Correct, the objective is application messaging, not user messaging. 
Like other aspects of the UX e.g. that supported by the Web since AJAX became 
popular, we don't think it's necessary or effective to require the user to be 
involved in all client-server interactions.

If that's case, how are we planning to handle waking up application A
without disrupting the experience of the user currently busy using
application B in the foreground (thinking essentially of mobile here)?

bryan Apps that can be automatically woken up would benefit from need 
enabling cooperative design that results in a good UX, e.g. the ability to be 
invoked and startup in the background, if there is another foreground app 
(whether in the Web runtime or a native app), and inform the user through 

RE: [admin] Mail List Policy, Usage, Etiquette, etc. Top-posting

2012-06-01 Thread SULLIVAN, BRYAN L
Response inline.

Thanks,
Bryan Sullivan 


-Original Message-
From: Tobie Langel [mailto:to...@fb.com] 
Sent: Thursday, May 31, 2012 4:06 PM
To: SULLIVAN, BRYAN L; ife...@google.com; Karl Dubost
Cc: WebApps WG
Subject: Re: [admin] Mail List Policy, Usage, Etiquette, etc.  Top-posting

On 5/31/12 11:58 PM, SULLIVAN, BRYAN L bs3...@att.com wrote:

bryan How about a practical suggestion for the (probably many) of us
that have to use Microsoft Outlook?

From: http://wiki.whatwg.org/wiki/FAQ#Mailing_List


If you use Outlook or Outlook Express, you can use either Outlook-QuoteFix
[1] or OE-QuoteFix[2]. These plugins fix several of Outlook's problems
with sending properly formatted emails.

bryan Sorry, I should have said Outlook as typically approved by corporate 
IT departments which does not include plugins.

--tobie

---
[1]: http://home.in.tum.de/~jain/software/outlook-quotefix
[2]: http://home.in.tum.de/~jain/software/oe-quotefix




RE: Is Quota Management API ready for First Public Working Draft?

2012-05-31 Thread SULLIVAN, BRYAN L
I support the FPWD publication.

Thanks,
Bryan Sullivan 

-Original Message-
From: Arthur Barstow [mailto:art.bars...@nokia.com] 
Sent: Tuesday, May 29, 2012 6:40 AM
To: ext Kinuko Yasuda; WebApps WG
Subject: Is Quota Management API ready for First Public Working Draft?

Hi Kinuko, All - what are people's thoughts on whether or not the Quota 
Management API spec is ready for First Public Working Draft?

A rule of thumb for FPWD is that the ED's scope should cover most of 
the expected functionality although the depth of some functionality may 
be very shallow, and it is OK if there are open bugs/issues.

-Thanks, Art

On 5/29/12 12:30 AM, ext Kinuko Yasuda wrote:
 On Wed, May 23, 2012 at 9:32 PM, Anne van Kesteren ann...@annevk.nl 
 mailto:ann...@annevk.nl wrote:

 On Wed, May 23, 2012 at 2:05 PM, Kinuko Yasuda
 kin...@chromium.org mailto:kin...@chromium.org wrote:
  https://dvcs.w3.org/hg/quota/raw-file/tip/Overview.html

 I noticed something else. StorageInfo is marked as Supplemental and
 NoInterfaceObject, but I do not think either is meant to be used here.
 Supplemental has been replaced by partial interface (rather than
 [Supplemental] interface), but is only supposed to be used if this
 is not the original definition (and I do not think StorageInfo is
 defined elsewhere). NoInterfaceObject is used prevent certain
 interfaces from being prototyped, but I do not think we want that here
 either.


 Oops.. thanks very much for pointing out those mistakes.
 You're right, neither Supplemental nor NoInterfaceObject look 
 appropriate here.
 I dropped them from the draft.

 https://dvcs.w3.org/hg/quota/raw-file/tip/Overview.html

 Thanks!





RE: [admin] Mail List Policy, Usage, Etiquette, etc. Top-posting

2012-05-31 Thread SULLIVAN, BRYAN L
bryan Comment inline.

From: Ian Fette (イアンフェッティ) [mailto:ife...@google.com] 
Sent: Tuesday, May 29, 2012 10:42 AM
To: Karl Dubost
Cc: WebApps WG
Subject: Re: [admin] Mail List Policy, Usage, Etiquette, etc.  Top-posting

On Tue, May 29, 2012 at 10:32 AM, Karl Dubost ka...@opera.com wrote:

Le 29 mai 2012 à 12:59, Ian Fette (イアンフェッティ) a écrit :
 And your modified reply causes GMail not to collapse the replied-to text
seems to be a GMail issue.

[…]
 resolved by using an up-to-date MUA.
Dare putting a list somewhere?

Sure, how about:

• Thunderbird 12
• GMail
• Mail.app
• Opera Mail 11.64
bryan How about a practical suggestion for the (probably many) of us that 
have to use Microsoft Outlook? In my experience the conversion of rich text or 
html to plain text involves significant one-way conversion in the content. And 
it's not clear at all how to get the towers effect, so emails end up with a 
combination of MUA-applied formatting and adhoc formatting. I think unless W3C 
(1) mandates all email discussion be done through the mail archive website, (2) 
enabled the ability to respond on the archive website (and not just invoke the 
default MUA), and (3) enforces the towers effect in replies to ensure 
consistency, we will not achieve effective, consistent use of plain text and 
inline commenting for W3C email.


RE: Push API draft uploaded

2012-05-31 Thread SULLIVAN, BRYAN L
Responses inline.

Thanks,
Bryan Sullivan 
-Original Message-
From: Mounir Lamouri [mailto:mou...@lamouri.fr] 
Sent: Wednesday, May 30, 2012 2:15 AM
To: public-webapps@w3.org
Subject: Re: Push API draft uploaded

On 05/29/2012 06:13 PM, SULLIVAN, BRYAN L wrote:
 * I wonder if it is really useful to have clients requesting a specific
 Push service. I totally understand why a user would request to use his
 preferred Push service but that is part of the UA. I would tend to think
 we should not add that parameter until it's proven to be needed by some
 consumer of the API. Adding it would be simple; removing it might not be
 an option. Also, allowing a website to chose the Push service might
 break the entire idea of decentralization here: you might end up with
 most websites requesting to use push.popularservice.com.

 bryan If a service is effective and thus popular, why shouldn't it be 
 accessible to developers? Rather than break decentralization, this 
 flexibility enables it IMO, so I think there is a misunderstanding 
 somewhere. To enable some degree of Push service (and thus service provider) 
 flexibility, I have also proposed that we could use Web Intents as a way to 
 allow the user to select the service provider, but if the app has particular 
 requirements (e.g. security or delivery methods/bearers), I see no reason 
 why we should obfuscate the developer intent by making the user play the 
 match maker. The requested service URL also provides means to negotiate 
 additional functionality/options between the app and the Push service 
 directly e.g. as above (e.g. security, delivery methods/bearers, application 
 characteristics, ...).
 
 I don't how this could be related to Web Intents? Picking the service
 provider should be up to the UA (using whichever method the UA feels
 appropriate). If a website *needs* a specific service provider that
 means this API has been a failure so I wouldn't add a parameter that
 would help this happen.
 
 bryan The concept of service provider selection by the user (in essence the 
 provider of some functionality distributed as Web pages/applications/workers 
 etc) is fundamental to the Web Intents concept, so it seemed natural to me to 
 consider that for this API. I don't think UA's should be exclusively 
 responsible for service provider selection, for this purpose or others. If 
 service providers can be more flexibly integrated through APIs such as Web 
 Intents IMO that is good for the Web.

I do not understand why a concept should be used in this specification
because it is used in Web Intents. And I do not understand why making an
API integrated with Web Intents is good for the Web. Really

bryan The concept of a requested service URL is not in this spec because the 
concept is used in or borrowed from Web Intents. The concept is there because 
it allows developers the flexibility of Push service provider selection. On its 
own, it has no dependency upon Web Intents. I mention Web Intents only to 
illustrate that as an additional potential mechanism, it can be considered as a 
specific way to get the user involved in the Push service provider selection, 
if the developer has no preference in the matter.

 * |readyState| should be a DOMString.

 bryan The jury is out on this, AFAICT. It's a short in EventSource and 
 XHR. I was following their lead.
 
 I don't know for XHR but the new way is DOMString for multiple
 reasons. I believe Ms2ger pointed you to a link which likely explains those.
 
 bryan If we can get Webapps resolution on that as a recommended design 
 approach going forward, as I said I am open to this. Perhaps the XHR and 
 EventSource editors can voice an opinion here?

XHR just can't be changed, this is why it is keeping integers instead of
string for errors. I do not know for EventSource. Anyhow, I'm not going
to argue more on that subject.

 * I guess the idea of |onmessage| is that the PushService instance will
 get an event when the backend will push a notification to the webapp.
 However, I wonder how you do handle the situation when the application
 is actually not being ran. Or should we wait for it to be launched?
 Anyhow, coupling the URL request and the event handling at the same
 place seems weird.

 bryan Not at all. This is the way that EventSource works for example (the 
 message handler is overtly associated with the request to a specific service 
 URL). I'm not sure what you mean by when the application is actually not 
 being ran... if you mean when the app is not running, the answer is yes, 
 the app should be started and the event then delivered to it.
 
 Running a webapp/website then sending an event to it seems a rather hard
 task. This is actually what motivated the System Message Handler API.
 
 bryan I'm not sure how it's hard; the Webapp just arranges for Push message 
 delivery when it is invoked, and events are delivered to the object that 
 represents the service arrangement (whether connection-based

RE: Push API draft uploaded

2012-05-29 Thread SULLIVAN, BRYAN L
No, the proposal at https://wiki.mozilla.org/Services/Notifications/Push/API. 
This was mentioned by Jonas at the Webapps meeting as the way that Mozilla is 
looking at this API. In that API there are two methods: 
requestRemotePermission() and checkRemotePermission();

But also separately, I am considering how Web Intents can be used for API 
service provider discovery, and use.

Thanks,
Bryan Sullivan 

-Original Message-
From: Mounir Lamouri [mailto:mou...@lamouri.fr] 
Sent: Tuesday, May 29, 2012 2:48 AM
To: public-webapps@w3.org
Subject: Re: Push API draft uploaded

On 05/25/2012 04:00 PM, SULLIVAN, BRYAN L wrote:
 [...] I am following the Mozilla lead on registering the intent to receive 
 messages, [...].

I'm not sure I understand. Do you mean the proposal on the wiki page is
proposing to use intents?

--
Mounir




RE: Push API draft uploaded

2012-05-29 Thread SULLIVAN, BRYAN L
Responses inline.

Thanks,
Bryan Sullivan 
-Original Message-
From: Mounir Lamouri [mailto:mou...@lamouri.fr] 
Sent: Tuesday, May 29, 2012 3:06 AM
To: public-webapps@w3.org
Subject: Re: Push API draft uploaded

On 05/26/2012 05:06 AM, SULLIVAN, BRYAN L wrote:
 * As far as I understand it, |requestRemotePermission| and
 |checkRemotePermission| could be one single method which could be named
 something like |getPushServiceUrl|. The only difference between those
 two methods is the permission asking part but that should stay as a UA
 decision. Given that the method is anyway asynchronous, the UA can do
 whatever wanted before sending a result. Showing a permission prompt
 could be one of those.
 
 bryan I agree that these methods could collapse into one. But as this 
 interface was based upon the Mozilla proposal 
 (https://wiki.mozilla.org/Services/Notifications/Push/API) I would like to 
 get the author's view on the potential to collapse the two methods into one.

I wouldn't name the proposal on the wiki page as Mozilla's proposal.
This wiki is public and what is described is far from being a finished work.
In addition, the wiki page is quite explicit about the existence of
those two methods and the given reasons are quite invalid.

bryan OK, I am open to collapsing these two methods into one, and will update 
the draft with a proposal for that.

 * I wonder if it is really useful to have clients requesting a specific
 Push service. I totally understand why a user would request to use his
 preferred Push service but that is part of the UA. I would tend to think
 we should not add that parameter until it's proven to be needed by some
 consumer of the API. Adding it would be simple; removing it might not be
 an option. Also, allowing a website to chose the Push service might
 break the entire idea of decentralization here: you might end up with
 most websites requesting to use push.popularservice.com.
 
 bryan If a service is effective and thus popular, why shouldn't it be 
 accessible to developers? Rather than break decentralization, this 
 flexibility enables it IMO, so I think there is a misunderstanding somewhere. 
 To enable some degree of Push service (and thus service provider) 
 flexibility, I have also proposed that we could use Web Intents as a way to 
 allow the user to select the service provider, but if the app has particular 
 requirements (e.g. security or delivery methods/bearers), I see no reason why 
 we should obfuscate the developer intent by making the user play the match 
 maker. The requested service URL also provides means to negotiate additional 
 functionality/options between the app and the Push service directly e.g. as 
 above (e.g. security, delivery methods/bearers, application characteristics, 
 ...).

I don't how this could be related to Web Intents? Picking the service
provider should be up to the UA (using whichever method the UA feels
appropriate). If a website *needs* a specific service provider that
means this API has been a failure so I wouldn't add a parameter that
would help this happen.

bryan The concept of service provider selection by the user (in essence the 
provider of some functionality distributed as Web pages/applications/workers 
etc) is fundamental to the Web Intents concept, so it seemed natural to me to 
consider that for this API. I don't think UA's should be exclusively 
responsible for service provider selection, for this purpose or others. If 
service providers can be more flexibly integrated through APIs such as Web 
Intents IMO that is good for the Web.

 * I'm not sure why you have a |requestUrl| attribute in PushService. Do
 you have any use case for that?
 
 bryan The use case is that an app can have multiple Push service requests 
 active at a time, with different URLs. In order to be able to associate each 
 PushService object with a specific set of options or services for example, it 
 needs to know what URL was used when the PushService object was created. The 
 intent is similar to that of EventSource, which has the url attribute for a 
 similar purpose (at least that is how I have used it). And since the 
 checkRemotePermission() method needs to verify the permission for the same 
 URL, it is better to have the resolved form of the URL available as an 
 attribute, so that it's easy to call the checkRemotePermission() method for 
 the right URL (as the absolute URL may have changed since the original 
 resolution).

The resolving part seems quite useless because contrary to EventSource,
it might be pretty uncommon to use a relative path to the push service.
Anyhow, I think this should disappear with the parameter in the methods.
The client shouldn't know which server is used: this is part of the
user's privacy.

bryan But as with EventSource, we won't know if the service URL will be 
commonly relative, or not. EventSource itself is quite young in terms of 
adoption, and with CORS there are good reasons why the path *won't

RE: [manifest] screen sizes, Re: Review of Web Application Manifest Format and Management APIs

2012-05-27 Thread SULLIVAN, BRYAN L
Re At install time or when I am browsing apps, how does a server know my 
screen resolution? Or is this restriction imposed on by the user agent?: When 
browsing apps, the server can easily access the screen and window DOM 
attributes. When installing apps, the installer (browser, app manager, etc) can 
provide a warning to the user that the app is designed for use on larger 
screens, and may not work properly on this device.

Thanks,
Bryan Sullivan 

-Original Message-
From: Marcos Caceres [mailto:w...@marcosc.com] 
Sent: Sunday, May 27, 2012 1:35 AM
To: Anant Narayanan
Cc: SULLIVAN, BRYAN L; public-webapps@w3.org
Subject: Re: [manifest] screen sizes, Re: Review of Web Application Manifest 
Format and Management APIs



On 26 May 2012, at 18:32, Anant Narayanan an...@mozilla.com wrote:

 On 05/25/2012 09:25 AM, Marcos Caceres wrote:
 
 
 On Friday, May 25, 2012 at 4:34 PM, SULLIVAN, BRYAN L wrote:
 
 Marcos,
 
 Re I thought we had stopped the whole designing for particular screen 
 sizes, etc. a long time ago., that may be the still-closely-held goal, but 
 the reality is that designing for multiple screen sizes (and pixel 
 densities) is still far from simple. Even with all the tools that have been 
 developed in CSS and Media Queries.
 
 So if developers want to claim that they have focused their design on 
 specific form factors (and presumably tested it thoroughly on them), this 
 seems like a good thing as it allows them to be more certain that their 
 apps won't be distributed to users of devices on which they won't work well 
 (which will negatively impact the developer's reputation, use of the app, 
 appstore etc), or if distributed to such users, will be clearly identified 
 as not being designed for those devices.
 
 Like many of the things we wanted to do in widget manifest structures in 
 BONDI and WAC, if these get pulled from the plan the only fallback is 
 developer ecosystem-specific app metadata, which in the end evaporates with 
 the developer ecosystems, or never achieves widespread use or 
 interoperability. So the problem is not solved for developers by leaving 
 these things out of standards, where there is a strong use case.
 
 
 Still sounds to me like Made forinsert everyone's favorite 90's browser 
 here, and best viewed at 800x600 … and look how well that turned out. Even 
 if we don't focus on mobile devices, it seems like a silly requirement as I 
 can just adjust my browser window to whatever size I want (there is no 
 reason to believe I won't be able to do that on future mobile devices). 
 I.e., screen size and application display area are not the same thing and 
 this metadata attribute seems to assume so.
 
 The intent for the screen_size parameters is not to let the developer enforce 
 a particular screen size or resolution, but rather specify the *minimum* 
 width and height required by the app. This means that on a screen below the 
 specified size, the app will not function at all.

To make this more clear, maybe call this min_screen_size. 

 
 I will also note that it is upto the app store to interpret this field 
 however they'd like. If they do not want to disallow installs on devices that 
 don't meet the developer-specified criteria, that's fine. However, we should 
 still convey this information from the developer to the store via the 
 manifest.

At install time or when I am browsing apps, how does a server know my screen 
resolution? Or is this restriction imposed on by the user agent?

 It is unrealistic to assume that all app developers will make a responsive 
 design for all possible screen sizes. The tools aren't great and it costs 
 time and money. We added this field after we received a request from the 
 developer of a popular game that only worked on desktops, but not mobile 
 phones (due to size). They wanted to make sure users weren't able to install 
 them in places the app wasn't designed for and get a bad impression of the 
 company. I think this is really important.

I think that's fine, but as Scott pointed pointed out, user agents have a 
history of allowing users to bypass these kinds of restrictions (or users hack 
around them). I think this field can only really serve as a warning that the 
app might not work as expected. 



RE: [manifest] screen sizes, Re: Review of Web Application Manifest Format and Management APIs

2012-05-27 Thread SULLIVAN, BRYAN L
OK, response inline. Below is a response to your request, unfortunately 
top-posted as I think this is an important procedural point and needs the 
visibility.

Re top-posting, I wasn't even aware of the practice or term. FYI for me it's 
the natural way to respond, easier to focus on what I want to respond to or 
what others have responded to (if they follow a similar practice). Its follows 
the natural flow of conversation, in which what the last person said (and the 
one before, etc...) does not have to be repeated by every person. Only the 
minimum necessary context should need be provided for the next comment.

To me, top-posting as you refer to it is easier than digging through emails 
with widely inconsistent methods of in-place responses (in which who said what 
can be very difficult to follow, unless you go back and reconstruct the whole 
thread, and even then it's not easy). 

If we want to mandate that all comments start with a commenter tag (e.g. 
bryan) and if breaking a previous paragraph also include a close tag 
(/bryan) then in-line commenting makes more sense to me.

I also note that the recommendation for inline commenting is a note on a WHATWG 
wiki, not a W3C convention. And even within itself seems contradictory... and 
my practice is consistent with what it recommends as Quote enough original 
text or provide an introduction yourself.

Thanks,
Bryan Sullivan 

-Original Message-
From: Marcos Caceres [mailto:w...@marcosc.com] 
Sent: Sunday, May 27, 2012 5:12 AM
To: SULLIVAN, BRYAN L
Cc: Anant Narayanan; public-webapps@w3.org
Subject: Re: [manifest] screen sizes, Re: Review of Web Application Manifest 
Format and Management APIs

On 27/05/2012 12:36, SULLIVAN, BRYAN L wrote:
 Re At install time or when I am browsing apps, how does a server know my 
 screen resolution? Or is this restriction imposed on by the user agent?: 
 When browsing apps, the server can easily access the screen and window DOM 
 attributes.
Right, but that requires some communication that is implicit in the 
spec. I'm trying to figure out what data is leaving my device and going 
to the server, and why (i.e., what is the expected life cycle model). 
There is all sorts of things that are implied going on behind the scenes 
that this spec eludes to (e.g., installation management/sync across 
devices), and it's good to get a sense of how it all comes together. If 
it's not clear in the spec, then I have a hard time seeing how multiple 
user agents will be able behave in an interoperable manner.
   When installing apps, the installer (browser, app manager, etc) can provide 
 a warning to the user that the app is designed for use on larger screens, and 
 may not work properly on this device.
Sure, but doesn't that lead to the original complaint that certain 
developers don't want their application to install at all for PR reasons?
bryan That preference to prevent installation on incompatible devices is 
reasonable, but then they likely need to control distribution, e.g. use the 
metadata (and device info) at the appstore to prevent the app from being 
offered at all, and prevent side-loading as far as possible. User agents could 
also provide a don't install incompatible apps option for users. For the 
rest, a warning will at least focus the responsibility on the user; I think 
they will be less likely to complain if given fair warning.

Ps: Bryan, can I kindly ask that you please stop top-posting on W3C 
mailing lists. It makes it hard to keep threads together. Please see:
http://wiki.whatwg.org/wiki/FAQ#Should_I_top-post_or_reply_inline.3F

 Thanks,
 Bryan Sullivan

 -Original Message-
 From: Marcos Caceres [mailto:w...@marcosc.com]
 Sent: Sunday, May 27, 2012 1:35 AM
 To: Anant Narayanan
 Cc: SULLIVAN, BRYAN L; public-webapps@w3.org
 Subject: Re: [manifest] screen sizes, Re: Review of Web Application Manifest 
 Format and Management APIs



 On 26 May 2012, at 18:32, Anant Narayanan an...@mozilla.com wrote:

 On 05/25/2012 09:25 AM, Marcos Caceres wrote:

 On Friday, May 25, 2012 at 4:34 PM, SULLIVAN, BRYAN L wrote:

 Marcos,

 Re I thought we had stopped the whole designing for particular screen 
 sizes, etc. a long time ago., that may be the still-closely-held goal, 
 but the reality is that designing for multiple screen sizes (and pixel 
 densities) is still far from simple. Even with all the tools that have 
 been developed in CSS and Media Queries.

 So if developers want to claim that they have focused their design on 
 specific form factors (and presumably tested it thoroughly on them), this 
 seems like a good thing as it allows them to be more certain that their 
 apps won't be distributed to users of devices on which they won't work 
 well (which will negatively impact the developer's reputation, use of the 
 app, appstore etc), or if distributed to such users, will be clearly 
 identified as not being designed for those devices.

 Like many of the things we wanted to do in widget manifest

RE: Push API draft uploaded

2012-05-25 Thread SULLIVAN, BRYAN L
Hi Jose,

Thanks for the comments.

Re the idea is to decouple permissions from APIs: potentially for the Sysapps 
WG this will be possible, but currently in DAP and in Webapps if the Web 
security model isn't enough (e.g. same-origin and CORS), then any special 
considerations are addressed in the API specs themselves. In this case the 
ability to invoke the app (wakeup) and receive Push messages when the app is 
offline in general (as in the Mozilla proposal) goes beyond the ability of 
same-origin and CORS to ensure user protection. Thus the user is prompted at 
least once. It's not a perfect solution but at least consistent with what has 
been the approach, and usable until we get to a more robust permissions 
framework.

Re wakeup as part of an App Manifest: this does not yet apply to Web apps in 
general. It does seem useful to consider in the Web app manifest 
(https://people.mozilla.com/~anarayanan/webapps.html) as proposed to be worked 
in Webapps, but again that does not apply (or does not have to be used) for all 
Web apps. I suppose one could make the argument that if you expect to be woken 
up, the app should be installed, but I think caching also works for that (as 
described in the spec as Examples of cases in which webapps should be 
invokable).

Re distinguish between registering the interest on receiving push messages and 
receiving push messages themselves: I am following the Mozilla lead on 
registering the intent to receive messages, and also going beyond it with the 
actual reception capability, and there are separate interfaces for the two 
functions. We don't yet have a generic intent registration mechanism for use 
here (e.g. based upon the API feature URL concept previously proposed for 
Widgets and leveraged in WAC), and we may approach that again in Sysapps (TBD), 
but for now I think the APIs need to address both functions.

Re the possibility of having a queue of pending messages: the spec leaves 
this as a MAY for now: When a Push message is received, the user agent must 
deliver the message data via the onmessage handler, if possible. If delivery is 
not possible, the user agent may discard the message, or may queue it for later 
delivery.

Thanks,
Bryan Sullivan 

-Original Message-
From: JOSE MANUEL CANTERA FONSECA [mailto:j...@tid.es] 
Sent: Friday, May 25, 2012 4:36 AM
To: SULLIVAN, BRYAN L; public-webapps
Subject: Re: Push API draft uploaded

I have some comments:

I think the idea is to decouple permissions from APIs, making that part of
a Security Model, so I don't understand why we are putting here that
functionality.

Concerning wakeup, etc. I think that should not be part of the API itself
but of the App Manifest

I think we need to distinguish between registering the interest on
receiving push messages and receiving push messages themselves.

The current API does not address the possibility of having a queue of
pending messages.

best

El 24/05/12 09:14, SULLIVAN, BRYAN L bs3...@att.com escribió:

Thanks to the inestimable help of the W3C staff I am now plugged into the
mercurial mainline and have uploaded the first stab at the Push API
http://dvcs.w3.org/hg/push/raw-file/default/index.html

I incorporated Mozilla's client API ideas in
https://wiki.mozilla.org/Services/Notifications/Push/API as the
PushManager interface, and also in the PushService interface with
some additions to support a more explicit event model for received
message delivery, derived from Server-Sent Events.

A lot is still left unsaid, and I will work on examples.

I also have not addressed the server API aspect that Mozilla mentioned in
their proposal. Like a lot that is left unsaid in their client API
proposal (how does the browser determine what that magic server URL
is...?), the server API is likely related to the specific Push service
that is bound to the API. I am considering the use of Web Intents to
discover and select the Push Service provider that the user wants apps to
use, assuming that we can leave the backend details to the intent
provider. I'm not yet sure how the pieces will fit together, how much
needs to be defined, and how my earlier proposal about specific event
source selection and filtering fits into this, but it's a start.

Thanks,
Bryan Sullivan







Este mensaje se dirige exclusivamente a su destinatario. Puede consultar 
nuestra política de envío y recepción de correo electrónico en el enlace 
situado más abajo.
This message is intended exclusively for its addressee. We only send and 
receive email on the basis of the terms set out at
http://www.tid.es/ES/PAGINAS/disclaimer.aspx



RE: [manifest] screen sizes, Re: Review of Web Application Manifest Format and Management APIs

2012-05-25 Thread SULLIVAN, BRYAN L
Marcos, 

Re I thought we had stopped the whole designing for particular screen sizes, 
etc. a long time ago., that may be the still-closely-held goal, but the 
reality is that designing for multiple screen sizes (and pixel densities) is 
still far from simple. Even with all the tools that have been developed in CSS 
and Media Queries. 

So if developers want to claim that they have focused their design on specific 
form factors (and presumably tested it thoroughly on them), this seems like a 
good thing as it allows them to be more certain that their apps won't be 
distributed to users of devices on which they won't work well (which will 
negatively impact the developer's reputation, use of the app, appstore etc), or 
if distributed to such users, will be clearly identified as not being designed 
for those devices.

Like many of the things we wanted to do in widget manifest structures in BONDI 
and WAC, if these get pulled from the plan the only fallback is developer 
ecosystem-specific app metadata, which in the end evaporates with the developer 
ecosystems, or never achieves widespread use or interoperability. So the 
problem is not solved for developers by leaving these things out of standards, 
where there is a strong use case.

Thanks,
Bryan Sullivan 

-Original Message-
From: Marcos Caceres [mailto:w...@marcosc.com] 
Sent: Friday, May 25, 2012 7:43 AM
To: Anant Narayanan
Cc: public-webapps@w3.org
Subject: [manifest] screen sizes, Re: Review of Web Application Manifest Format 
and Management APIs




On Sunday, May 13, 2012 at 5:47 PM, Anant Narayanan wrote:

   screen_size: This object may contain the min_height and min_width 
   properties that describe the minimum height and width (in pixels) the 
   application needs in order to render correctly. Interpretation of these 
   values is left up to the runtime and/or app store.
  
  
  
  How does this play with CSS and media queries in particular? What's the use 
  case?
 
 These values do not interfere with runtime detection via media queries.
 The use case for these values is two-fold:
 - An app store may prevent the user from installing an app on a device
 which doesn't meet this criteria
 - A UA may prevent the user from launching an app on a device which
 doesn't meet this criteria
 
 The primary goal in both cases is to let the developer declare what
 screen sizes their app is known to work correctly.

The above cases seems very anti-web IMHO. I thought we had stopped the whole 
designing for particular screen sizes, etc. a long time ago. I feel it would be 
a shame to codify this in a spec.

-- 
Marcos Caceres






RE: [manifest] screen sizes, Re: Review of Web Application Manifest Format and Management APIs

2012-05-25 Thread SULLIVAN, BRYAN L
Perhaps this particular issue then (the need to convey information about 
intended usage of an app, or preferred device characteristics), especially 
designing for a diverse set of devices and screen characteristics (mobile 
phones up to building-side billboards), should be something that we encourage 
developer input on through the community group process. My sense is that it's a 
bigger problem than it seems, and that by just saying apps should work on any 
device or apps should not be tailored to specific device characteristics 
thus we don't need such metadata in manifests, we are doing developers a 
disservice. It's much more complicated than that, and I believe developers *do* 
commonly focus on particular device segments when designing Webapps.

Thanks,
Bryan Sullivan 

-Original Message-
From: Scott Wilson [mailto:scott.bradley.wil...@gmail.com] 
Sent: Friday, May 25, 2012 12:59 PM
To: Marcos Caceres
Cc: SULLIVAN, BRYAN L; Anant Narayanan; public-webapps WG; 
public-webappst...@w3.org
Subject: Re: [manifest] screen sizes, Re: Review of Web Application Manifest 
Format and Management APIs

On 25 May 2012, at 17:25, Marcos Caceres wrote:

 
 
 On Friday, May 25, 2012 at 4:34 PM, SULLIVAN, BRYAN L wrote:
 
 Marcos,  
 
 Re I thought we had stopped the whole designing for particular screen 
 sizes, etc. a long time ago., that may be the still-closely-held goal, but 
 the reality is that designing for multiple screen sizes (and pixel 
 densities) is still far from simple. Even with all the tools that have been 
 developed in CSS and Media Queries.  
 
 So if developers want to claim that they have focused their design on 
 specific form factors (and presumably tested it thoroughly on them), this 
 seems like a good thing as it allows them to be more certain that their apps 
 won't be distributed to users of devices on which they won't work well 
 (which will negatively impact the developer's reputation, use of the app, 
 appstore etc), or if distributed to such users, will be clearly identified 
 as not being designed for those devices.

I think there is a problem here that we can get very mobile and tablet focussed 
- some of our widgets are also designed with interactive whiteboards and TVs in 
mind which may throw off selections based on things like screen size and pixel 
density. 

I can see users ending up doing the whole spoof the user-agent string again 
here, as when sites started showing your browser is not supported when you 
viewed them with something the developer hadn't considered. 

Perhaps at the store level it would be nice to have some assertions of 
platforms tested by the developer, but that would be something different really 
(perhaps something for the web app stores CG to look at).

 
 Like many of the things we wanted to do in widget manifest structures in 
 BONDI and WAC, if these get pulled from the plan the only fallback is 
 developer ecosystem-specific app metadata, which in the end evaporates with 
 the developer ecosystems, or never achieves widespread use or 
 interoperability. So the problem is not solved for developers by leaving 
 these things out of standards, where there is a strong use case.
 
 
 Still sounds to me like Made for insert everyone's favorite 90's browser 
 here, and best viewed at 800x600 ... and look how well that turned out. 
 Even if we don't focus on mobile devices, it seems like a silly requirement 
 as I can just adjust my browser window to whatever size I want (there is no 
 reason to believe I won't be able to do that on future mobile devices). I.e., 
 screen size and application display area are not the same thing and this 
 metadata attribute seems to assume so.
 
 --  
 Marcos Caceres
 
 
 
 




RE: Push API draft uploaded

2012-05-25 Thread SULLIVAN, BRYAN L
Thanks for the comments. Some responses added as bryan

Thanks,
Bryan Sullivan

-Original Message-
From: Mounir Lamouri [mailto:mou...@lamouri.fr] 
Sent: Friday, May 25, 2012 3:17 PM
To: public-webapps@w3.org
Subject: Re: Push API draft uploaded

On 05/24/2012 09:14 AM, SULLIVAN, BRYAN L wrote:
 Thanks to the inestimable help of the W3C staff I am now plugged into the 
 mercurial mainline and have uploaded the first stab at the Push API
 http://dvcs.w3.org/hg/push/raw-file/default/index.html
 
 I incorporated Mozilla's client API ideas in 
 https://wiki.mozilla.org/Serices/Notifications/Push/API as the PushManager 
 interface, and also in the PushService interface with some additions to 
 support a more explicit event model for received message delivery, derived 
 from Server-Sent Events.
 
 A lot is still left unsaid, and I will work on examples.
 
 I also have not addressed the server API aspect that Mozilla mentioned in 
 their proposal. Like a lot that is left unsaid in their client API proposal 
 (how does the browser determine what that magic server URL is...?), the 
 server API is likely related to the specific Push service that is bound to 
 the API. I am considering the use of Web Intents to discover and select the 
 Push Service provider that the user wants apps to use, assuming that we can 
 leave the backend details to the intent provider. I'm not yet sure how the 
 pieces will fit together, how much needs to be defined, and how my earlier 
 proposal about specific event source selection and filtering fits into this, 
 but it's a start.

Hi,

I have a few random comments:

* As far as I understand it, |requestRemotePermission| and
|checkRemotePermission| could be one single method which could be named
something like |getPushServiceUrl|. The only difference between those
two methods is the permission asking part but that should stay as a UA
decision. Given that the method is anyway asynchronous, the UA can do
whatever wanted before sending a result. Showing a permission prompt
could be one of those.

bryan I agree that these methods could collapse into one. But as this 
interface was based upon the Mozilla proposal 
(https://wiki.mozilla.org/Services/Notifications/Push/API) I would like to get 
the author's view on the potential to collapse the two methods into one.

* I wonder if it is really useful to have clients requesting a specific
Push service. I totally understand why a user would request to use his
preferred Push service but that is part of the UA. I would tend to think
we should not add that parameter until it's proven to be needed by some
consumer of the API. Adding it would be simple; removing it might not be
an option. Also, allowing a website to chose the Push service might
break the entire idea of decentralization here: you might end up with
most websites requesting to use push.popularservice.com.

bryan If a service is effective and thus popular, why shouldn't it be 
accessible to developers? Rather than break decentralization, this flexibility 
enables it IMO, so I think there is a misunderstanding somewhere. To enable 
some degree of Push service (and thus service provider) flexibility, I have 
also proposed that we could use Web Intents as a way to allow the user to 
select the service provider, but if the app has particular requirements (e.g. 
security or delivery methods/bearers), I see no reason why we should obfuscate 
the developer intent by making the user play the match maker. The requested 
service URL also provides means to negotiate additional functionality/options 
between the app and the Push service directly e.g. as above (e.g. security, 
delivery methods/bearers, application characteristics, ...).

* I'm not sure why you have a |requestUrl| attribute in PushService. Do
you have any use case for that?

bryan The use case is that an app can have multiple Push service requests 
active at a time, with different URLs. In order to be able to associate each 
PushService object with a specific set of options or services for example, it 
needs to know what URL was used when the PushService object was created. The 
intent is similar to that of EventSource, which has the url attribute for a 
similar purpose (at least that is how I have used it). And since the 
checkRemotePermission() method needs to verify the permission for the same URL, 
it is better to have the resolved form of the URL available as an attribute, so 
that it's easy to call the checkRemotePermission() method for the right URL (as 
the absolute URL may have changed since the original resolution).

* |readyState| should be a DOMString.

bryan The jury is out on this, AFAICT. It's a short in EventSource and XHR. I 
was following their lead.

* I guess the idea of |onmessage| is that the PushService instance will
get an event when the backend will push a notification to the webapp.
However, I wonder how you do handle the situation when the application
is actually not being ran. Or should we wait

Push API draft uploaded

2012-05-24 Thread SULLIVAN, BRYAN L
Thanks to the inestimable help of the W3C staff I am now plugged into the 
mercurial mainline and have uploaded the first stab at the Push API
http://dvcs.w3.org/hg/push/raw-file/default/index.html

I incorporated Mozilla's client API ideas in 
https://wiki.mozilla.org/Services/Notifications/Push/API as the PushManager 
interface, and also in the PushService interface with some additions to 
support a more explicit event model for received message delivery, derived from 
Server-Sent Events.

A lot is still left unsaid, and I will work on examples.

I also have not addressed the server API aspect that Mozilla mentioned in their 
proposal. Like a lot that is left unsaid in their client API proposal (how does 
the browser determine what that magic server URL is...?), the server API is 
likely related to the specific Push service that is bound to the API. I am 
considering the use of Web Intents to discover and select the Push Service 
provider that the user wants apps to use, assuming that we can leave the 
backend details to the intent provider. I'm not yet sure how the pieces will 
fit together, how much needs to be defined, and how my earlier proposal about 
specific event source selection and filtering fits into this, but it's a start.

Thanks,
Bryan Sullivan





RE: Push API draft uploaded

2012-05-24 Thread SULLIVAN, BRYAN L
Thanks for the comments. I updated the spec:
- define what happens when url is omitted
- remove [NoInterfaceObject]
- define readyState as a unsigned short (that was what was meant in the first 
place)
- fix cut/paste errors

I still have to find the source of resolve a url as that's a function I 
borrowed from EventSource.

Latest version is at http://dvcs.w3.org/hg/push/raw-file/default/index.htm 

Thanks,
Bryan Sullivan

-Original Message-
From: Ms2ger [mailto:ms2...@gmail.com] 
Sent: Thursday, May 24, 2012 12:33 AM
To: SULLIVAN, BRYAN L
Cc: public-webapps
Subject: Re: Push API draft uploaded

On 05/24/2012 09:14 AM, SULLIVAN, BRYAN L wrote:
 Thanks to the inestimable help of the W3C staff I am now plugged into
 the mercurial mainline and have uploaded the first stab at the Push
 API
  http://dvcs.w3.org/hg/push/raw-file/default/index.html

A couple of notes on the WebIDL:

* PushManager has
   |PushService requestRemotePermission ([Optional] DOMString url);|,
   should be ... (optional DOMString url), though the spec doesn't
   appear to define what happens when url is omitted; same for
   checkRemotePermission.
* There does not appear to be a need to make PushManager and PushService
   use [NoInterfaceObject], so please remove that.
* PushService.readyState is a DOMString, but the spec defines it to
   return the unsigned short constants CONNECTING/OPEN/CLOSED. Please
   get rid of the constants.

The requestUrl attribute must return the absolute URL where the webapp 
server can send Push service messages to this webapp. should probably 
refer to |serviceUrl|, not |requestUrl|.

A reference to DOM4 for the DOMError interface should probably be added. 
Also, the resolve a url cross-reference is broken.

HTH
Ms2ger


RE: Push API draft uploaded

2012-05-24 Thread SULLIVAN, BRYAN L
Sorry, cut  paste error: the spec is at: 
http://dvcs.w3.org/hg/push/raw-file/default/index.html 

Thanks,
Bryan Sullivan 

-Original Message-
From: SULLIVAN, BRYAN L 
Sent: Thursday, May 24, 2012 6:02 AM
To: 'Ms2ger'
Cc: public-webapps
Subject: RE: Push API draft uploaded

Thanks for the comments. I updated the spec:
- define what happens when url is omitted
- remove [NoInterfaceObject]
- define readyState as a unsigned short (that was what was meant in the first 
place)
- fix cut/paste errors

I still have to find the source of resolve a url as that's a function I 
borrowed from EventSource.

Latest version is at http://dvcs.w3.org/hg/push/raw-file/default/index.htm 

Thanks,
Bryan Sullivan

-Original Message-
From: Ms2ger [mailto:ms2...@gmail.com] 
Sent: Thursday, May 24, 2012 12:33 AM
To: SULLIVAN, BRYAN L
Cc: public-webapps
Subject: Re: Push API draft uploaded

On 05/24/2012 09:14 AM, SULLIVAN, BRYAN L wrote:
 Thanks to the inestimable help of the W3C staff I am now plugged into
 the mercurial mainline and have uploaded the first stab at the Push
 API
  http://dvcs.w3.org/hg/push/raw-file/default/index.html

A couple of notes on the WebIDL:

* PushManager has
   |PushService requestRemotePermission ([Optional] DOMString url);|,
   should be ... (optional DOMString url), though the spec doesn't
   appear to define what happens when url is omitted; same for
   checkRemotePermission.
* There does not appear to be a need to make PushManager and PushService
   use [NoInterfaceObject], so please remove that.
* PushService.readyState is a DOMString, but the spec defines it to
   return the unsigned short constants CONNECTING/OPEN/CLOSED. Please
   get rid of the constants.

The requestUrl attribute must return the absolute URL where the webapp 
server can send Push service messages to this webapp. should probably 
refer to |serviceUrl|, not |requestUrl|.

A reference to DOM4 for the DOMError interface should probably be added. 
Also, the resolve a url cross-reference is broken.

HTH
Ms2ger


RE: Push API draft uploaded

2012-05-24 Thread SULLIVAN, BRYAN L
OK, I corrected the [NoInterfaceObject] (I hope), and referenced HTML5 for 
resolving a URL.

The numeric readyState was borrowed from EventSource. I will look at the 
thread, but I think this is something that I will just align with the consensus 
in the group once determined. I don't have a strong opinion either way.

Latest version is at http://dvcs.w3.org/hg/push/raw-file/default/index.html 

Thanks,
Bryan Sullivan 

-Original Message-
From: Ms2ger [mailto:ms2...@gmail.com] 
Sent: Thursday, May 24, 2012 6:37 AM
To: SULLIVAN, BRYAN L
Cc: public-webapps
Subject: Re: Push API draft uploaded

Hi Brian,

On 05/24/2012 03:02 PM, SULLIVAN, BRYAN L wrote:
 Thanks for the comments. I updated the spec:
 - define what happens when url is omitted
 - remove [NoInterfaceObject]
 - define readyState as a unsigned short (that was what was meant in the first 
 place)
 - fix cut/paste errors

 I still have to find the source of resolve a url as that's a function I 
 borrowed from EventSource.

 Latest version is at http://dvcs.w3.org/hg/push/raw-file/default/index.html

Thanks for the update. resolve a url is defined in HTML; see 
http://www.whatwg.org/html/#resolving-urls.

As for a numeric readyState, please have a look at the discussion at 
http://lists.w3.org/Archives/Public/public-script-coord/2012JanMar/0166.html.

Finally, it appears that you removed [NoInterfaceObject] from 
NavigatorPush (where I believe it was correct), rather than from 
PushService.

HTH
Ms2ger


Re: Push API draft uploaded

2012-05-24 Thread SULLIVAN, BRYAN L
Re a particular type of Push service that it supports this is intended to be 
generic so that new services (perhaps identified by unique URI schemes) can be 
covered under this.

That being said, WebSockets schemes clearly would imply that protocol, but http 
schemes could be more flexible. One of the goals is to define how the 
serviceUrl is conveyed to the user agent and Webapp. In the process of 
determining that URL, there could be other useful info that the server returns, 
eg the applicable bearer bindings or info that will help ensure events can be 
delivered to the correct Webapp (e.g. SMS source address, message 
fields/headers). If its possible to define a lightweight and generic/extensible 
Push service registration protocol, this would be a good place to invoke it. We 
defined such a protocol for OMA Push, and some of those ideas might be useful 
here. This is an area for further study.

If the Push server connection is setup to another domain then CORS would apply. 
But the checkRemotePermission method (at least as I understood it from the 
Mozilla proposal) would only test if there was a prior permission by the user, 
and would not need to invoke any network transactions to do so (though for some 
implementations this might be a feature).

I will try to develop these ideas in the draft (or at least outline the intent 
to), but I did not want to put too much into it at this time... As far as 
possible I am leaning to the simple (but clearly not as simple as the Mozilla 
proposal). Service lifecycle management, of which registration is a facet, can 
hopefully be layered above the API for the most part.

Thanks,
Bryan Sullivan

On May 24, 2012, at 9:33 AM, Charles Pritchard ch...@jumis.com wrote:

 On 5/24/2012 7:08 AM, SULLIVAN, BRYAN L wrote:
 OK, I corrected the [NoInterfaceObject] (I hope), and referenced HTML5 for 
 resolving a URL.
 
 The numeric readyState was borrowed from EventSource. I will look at the 
 thread, but I think this is something that I will just align with the 
 consensus in the group once determined. I don't have a strong opinion either 
 way.
 
 Latest version is athttp://dvcs.w3.org/hg/push/raw-file/default/index.html  
 
 Does the following mean that http/https are interpreted as EventSource and 
 ws/wss as WebSockets?
 Does checkRemotePermission trigger CORS checks for those protocols?
 
 If the url parameter is present and the user agent recognizes the url value 
 as a particular type of Push service that it supports, the user agent must 
 activate the service.
 
 My read on that is yes and yes, but I wanted to double-check.
 
 -Charles



RE: App Manifest API Proposal

2012-05-13 Thread SULLIVAN, BRYAN L
At least in the widget model, the manifest (including feature elements) 
provides a means of disclosure to the user about the APIs that the app wants to 
access. Of course if one assumes that users are brainless click-happy 
automatons then such disclosures are useless, but at that end of the extreme 
the value of curated appstore services is clear, to me at least. I note that 
appstores are big businesses for native platform vendors also, and I assume 
that they support extension of that model to Webapps.

There will always be a tension between the pure protection that a perfect Web 
security model will provide (good luck with that), and the (perhaps, sometimes 
misplaced) trust in a system of curation. But even in the apps come from 
servers camp, there is curation involved, by the Website operator (who creates 
links) and the user (who chooses what sites to visit). Someone has to choose. I 
personally do not think we can design a Web security model that eliminates all 
need for intelligent choices, whether supported through informed consent or by 
personal experience with a Website / app author.

On whether the concept of installation fits into the Web model, I note that 
Webapp device platforms are nearing launch, which will depend upon installation 
of apps as they will take the place of native apps (they become the native 
apps). A lot of apps will still of course be transient, as server-based models 
still have unique valuable features. But the Web is growing beyond the browser 
(as with Webview API's it's already been growing for a number of years), and to 
do so it needs to accommodate the curator-trust model of appstores, and the 
metadata that enables informed user consent.

Thanks,
Bryan Sullivan

-Original Message-
From: Marcos Caceres [mailto:w...@marcosc.com] 
Sent: Saturday, May 12, 2012 2:57 PM
To: Anant Narayanan; Ian Hickson
Cc: public-webapps
Subject: Re: App Manifest  API Proposal



On Saturday, 12 May 2012 at 21:14, Ian Hickson wrote:

 On Sat, 12 May 2012, Anant Narayanan wrote:
   
  Q. Apps are just web pages, why bother installing them?
   
  A. This has been previously discussed on the list [4].
  [4] http://lists.w3.org/Archives/Public/public-webapps/2012JanMar/0464.html
  
  
  
 This has already received a reply:
  
 http://lists.w3.org/Archives/Public/public-webapps/2012JanMar/0465.html
  
  
  There are clear differences in perception between an app and a website  
  for most users. Most web content is expected to be free, but the same  
  content wrapped in an app is something people seem to be willing to pay  
  for. Monetization is important to encourage a thriving web developer  
  community.
  
  
  
 I don't think it makes sense to use a technical solution to a  
 non-technical problem.

It's sometimes nice to have a curated space to find interesting apps - though I 
agree that this is not a technical problem, though the manifest format 
facilitates this to some respect *iff it fills gaps in the HTML spec with 
regards to metadata* (or maybe some API aspect, though I've not looked at those 
in any detail). If this warrants standardisation, I don't know… guess that is 
what we are trying to figure out. 
  Additionally, treating certain installed websites as apps gives us a  
  context separate from loading pages in a browser, which allows us to  
  provide privileged APIs to such trusted apps, APIs we would normally not  
  give to untrusted web content.
  
  
  
 Desktop operating systems have demonstrated over a period of many years  
 that this approach simply doesn't work. Users find it very difficult to  
 understand what it means to trust an app. The Web's security model is  
 IMHO significantly superior than any of the app security models we have  
 seen in native operating systems, as demonstrated by the way that when  
 malware is written to the app model it has to be dealt with by curating  
 the application market space, whereas when malware is written to the Web  
 model it is almost always because of errors in the design or  
 implementation of the Web platform that, once fixed, preclude any similar  
 attack from being performed again.
  
 The installation security model of asking the user up-front to grant  
 trust just doesn't work because users don't understand the question, and  
 the installation security model of curating apps and trying to determine  
 by empirical examination whether an application is trustworthy or not just  
 doesn't scale.
  

I agree with Ian about the above, which is why I was hopeful that feature 
thing is not needed in the manifest format (or the manifest format is not 
needed at all). Features have historically enable proprietary APIs (in Chrome 
extension, Opera extensions, and WAC for example), which likely won't 
interoperate (so features will also require standardisation).  

In my email I said that we (the widget-side of the Webapps WG) were hopeful 
that HTML would provide the needed app metadata to 

RE: App Manifest API Proposal

2012-05-13 Thread SULLIVAN, BRYAN L
Hi Anant,

Thanks for the proposal. It's good to see this moving forward, following the 
workshop we had last year after TPAC. 

Some initial comments:

1) Re version: A string that represents the version of this manifest. The 
User-Agent does not interpret this value in any way and is opaque to everyone 
but the application itself.: it's also likely that the privileged caller may 
also need to interpret this, as one key use case for the a privileged caller is 
an appstore client.

2) How do you propose that the manifest information be trusted, through 
signature on the JSON file?

3) Re softening of the requirement There must only be one application per 
origin.: you will likely need an App ID field (a URI), for which there should 
be only one installation at a time (otherwise per the manifest trust above, an 
untrusted app could pose as another app).

4) For which of the attributes, instead of being in a manifest, could we 
achieve the same purpose with HEAD section elements in the start page of the 
app? I guess this question comes down to what is the inherent value of a 
manifest, and also how can we get similar value for these attributes on normal 
Web pages (with no manifest).

Thanks,
Bryan Sullivan 

-Original Message-
From: Anant Narayanan [mailto:an...@mozilla.com] 
Sent: Saturday, May 12, 2012 11:02 AM
To: public-webapps
Subject: App Manifest  API Proposal

Hi everyone,

I recently joined the webapps working group and I'd like to introduce 
myself! I work at Mozilla and for the past year or so have been working 
on our Apps initiative [1]. Our goal has been to make it very easy for 
developers to build apps using web technologies that can go above and 
beyond what one might achieve using native SDKs on platforms like iOS 
and Android. We're also trying to make it really easy for users to find 
and acquire these apps, and use them on any device they happen to own 
regardless of platform.

As part of this work we have devised a simple JSON based manifest format 
to describe an installable web app, in addition to a few DOM APIs to 
install and manage these apps. We have a working implementation of the 
entire system in our latest Nightly builds.

The manifest and corresponding APIs are described in an early draft at:
http://dvcs.w3.org/hg/app-manifest/raw-file/tip/index.html

We'd like to propose using that draft as the basis for a FPWD on this 
topic. I look forward to your feedback!


FAQs
--
There are a few questions I anticipate in advance, which I will try to 
answer here, but we can definitely go in more depth as necessary on the 
list:

Q. Why not simply reuse the widgets spec [2]?

A. Aside from naming (we're talking about apps, the word widget seems 
to imply an artificial limitation), and replacing XML with JSON; the 
other fundamental difference is that the widget spec describes packaged 
apps, whereas our manifest describes hosted apps.

We think hosted apps have several interesting and unique web-like 
properties that are worth retaining. Hosted apps can be made to work 
offline just as well as packaged apps with AppCache (which is in need of 
some improvement, but can be made to work!). Packaged apps do have their 
own advantages though, which we acknowledge, and are open to extending 
the spec to support both types of apps.


Q. Why is the DOM API in the same spec as the manifest?

A. One success condition for us would be standardize the DOM APIs so 
that users will be able to visit any app marketplace that publishes web 
apps conforming to the manifest spec in any browser and be able to 
install and use them.

We understand there might be other platforms on which a JS API may not 
be feasible (for eg: A Java API to install and manage these apps is 
equally important), but that shouldn't preclude us from standardizing 
the DOM API in browsers. The manifest and the API go hand-in-hand, as we 
think each of them is dramatically less useful without the other.


Q. Why only one app per origin?

A. We originally placed this restriction for security reasons. In 
Firefox (and most other browsers), the domain name is the primary 
security boundary - cookie jars, localStorage, XHRs are all bound to the 
domain. For supporting multiple apps per domain we would have to do some 
extra work to ensure that (potentially sensitive) permissions granted to 
one app do not leak into another app from the same domain. Additionally, 
this lets us use the origin of the domain as a globally unique 
identifier. Note that app1.example.org and app2.example.org are two 
different origins under this scheme.

That said, we've received a lot of developer feedback about the 
inconvenience of this restriction, and we are actively looking to lift 
it [3]. We cannot do this without a few other changes around permissions 
and enforcing specific UA behavior in app mode (as opposed to browser 
mode), but is something we can work towards.


Q. Apps are just web pages, why bother installing them?

A. This has been 

Re: App Manifest API Proposal

2012-05-13 Thread SULLIVAN, BRYAN L
Ok, thanks for the responses.

For (1) we can expect a text change, right?

For (2), If the app manifest if obtained over non-secure HTTP, it is subject to 
modification. If the app is delivered over non-secure HTTP, even more can be 
modified. So is the plan to provide some kind of user warning when the manifest 
and/or app (including assets from the same origin) are delivered via non-secure 
HTTP (in the absence of a manifest signature)? And even if a manifest signature 
is provided how does it ensure protection of the assets (e.g. JS, CSS, and 
HTML) if they are delivered over non-secure HTTP? Does HTTPS need to be 
enforced, and cert domain validation as well?

For 3), I understand. We went through a lot of the similar issues in WAC, so 
maybe some of that experience will be useful in the discussion.

For 4), the ability to present the user with info/options prior to downloading 
the app (or its root page), or to process the manifest in an app manager / 
AppStore client, is probably the key added value. So from that perspective, i 
agree that supporting similar info In a Web page markup doesn't add value in 
this case, and does prevent the pre-processing capability.

Thanks,
Bryan Sullivan

On May 13, 2012, at 7:04 PM, Anant Narayanan an...@mozilla.com wrote:

 Hi Sullivan,
 
 Thanks for your comments, some responses inline:
 
 On 5/13/2012 1:11 AM, SULLIVAN, BRYAN L wrote:
 1) Re version: A string that represents the version of this manifest. The 
 User-Agent does not interpret this value in any way and is opaque to 
 everyone but the application itself.: it's also likely that the privileged 
 caller may also need to interpret this, as one key use case for the a 
 privileged caller is an appstore client.
 
 Yes, absolutely.
 
 2) How do you propose that the manifest information be trusted, through 
 signature on the JSON file?
 
 We haven't devised any signing scheme yet, we are only relying on manifests 
 being served over SSL for establishing trust. I recall someone from Google 
 saying something quote-worthy regarding this: If it's good enough for your 
 banking, it's good enough to install some apps :)
 
 That said, we are definitely open to adding signatures. This already seems 
 required for packaged apps for highly sensitive apps like phone dialers, as 
 we are discovering for B2G.
 
 3) Re softening of the requirement There must only be one application per 
 origin.: you will likely need an App ID field (a URI), for which there 
 should be only one installation at a time (otherwise per the manifest trust 
 above, an untrusted app could pose as another app).
 
 Correct, this is one of the reasons we enforce one app per origin (posing as 
 another app becomes very hard). Relaxing that restriction won't be trivial as 
 we have to consider this and many other repercussions.
 
 4) For which of the attributes, instead of being in a manifest, could we 
 achieve the same purpose with HEAD section elements in the start page of the 
 app? I guess this question comes down to what is the inherent value of a 
 manifest, and also how can we get similar value for these attributes on 
 normal Web pages (with no manifest).
 
 As I mentioned in another email, I'm not too worried about duplication in two 
 places as the goals are different. The point of storing such information in 
 the manifest is to enable various parties to make decisions about how they 
 will handle an app before purchase/install/launch time.
 
 As you noted in your previous email, the manifest is also an appropriate 
 place to let the developer declare what APIs they intend to use, regardless 
 of whether the UA asks for user permission up-front or at run-time.
 
 Regards,
 -Anant
 



Re: Offline Web Applications status

2012-05-04 Thread SULLIVAN, BRYAN L
I like the idea. This would be useful for various things, especially if we 
could integrate the discovery and selection of this feature (the local proxy 
Web service) through Web Intents.

Thanks,
Bryan Sullivan

On May 4, 2012, at 6:48 PM, Tab Atkins Jr. jackalm...@gmail.com wrote:

 On Thu, May 3, 2012 at 11:12 AM, Ian Hickson i...@hixie.ch wrote:
 An idea I was kicking around for this would be to simplify the three
 points above to instead have just a way to declare a JS file as being a
 local interceptor, and then have that JS file be automatically launched in
 a worker thread, and then every network request gets proxied through that
 worker in some well-defined manner. The worker could then either say do
 whatever you would normally do for that URL, or redirect to this URL and
 try again, or here's the data for that URL.
 
 How does that sound?
 
 So this is, more or less, running a local server in JS, right?  (One
 that only the page can talk to, of course.)
 
 If so, I definitely approve.  I think this is a great way to handle
 offline webapps, so the front-end can be written to assume that
 there's always *something* on the back-end that it can talk to.  This
 invariant greatly simplifies the mental cost of writing an app, I
 think.
 
 ~TJ
 



RE: [admin] A Method for Writing Testable Conformance Requirements

2012-05-03 Thread SULLIVAN, BRYAN L
Marcos,

I think it would be great to update the document. While in the Webapps F2F 
there were some good ideas also floated on supplemental metadata systems (e.g. 
as used in WHATWG for HTML5) that don't require editors to do anything, IMO we 
should also consider tooling that helps editors add in class tags or otherwise 
structure normative statements for more usability as test assertions. Both 
approaches have merit I believe.

The editing tools approach could also be supported through an update to ReSpec, 
as I have earlier discussed with Robin.

Thanks,
Bryan Sullivan 

-Original Message-
From: Marcos Caceres [mailto:w...@marcosc.com] 
Sent: Thursday, May 03, 2012 2:05 PM
To: Arthur Barstow
Cc: public-webapps
Subject: Re: [admin] A Method for Writing Testable Conformance Requirements




On Thursday, 3 May 2012 at 19:28, Arthur Barstow wrote:

 Editors, All,
 
 During WebApps' May 2 Testing topic [1], I mentioned the A Method for 
 Writing Testable Conformance Requirements document [2] by Dom and 
 Marcos. It describes a method for writing, marking-up, and analyzing 
 conformance requirements in technical specifications that could 
 facilitate test case creation. This is something our new Editors may 
 want to consider but note the minutes ([1]) also describe some other 
 methods that could be used.
 


It's bit out of date, but I'm happy to update it if anyone is interested. 

-- 
Marcos Caceres
http://datadriven.com.au






ReSpec biblio

2012-05-02 Thread SULLIVAN, BRYAN L
Hi Robin,

I'm starting to edit the Push API spec per the Webapps meeting in progress: 
http://www.w3.org/2008/webapps/wiki/May2012F2FMeeting (Server-Sent Events 
extended to work with other push notification schemes such as Push SMS).

Some questions on the ReSpec biblio:

*   Do you have a tool to get updates to the ReSpec biblio 
(http://dev.w3.org/2009/dap/ReSpec.js/biblio.html)? Or do we send updates to 
you?
*   Is there some more global version that that referenced in DAP specs?
*   What criteria do you use to decide what and how to reference? I see 
that not only W3C and IETF specs are referenced...
*   How do I add a bibilo reference in my spec if it's not yet in Respec 
(link to Respec help will suffice - I don't see it on the wiki)?
*   Can I create my own ReSpec biblio (external file that can be 
referenced)?

Thanks,
Bryan Sullivan




RE: publish LCWD of Server-sent Events; deadline April 23

2012-04-23 Thread SULLIVAN, BRYAN L
I support the LCWD publication.

Thanks,
Bryan Sullivan 

-Original Message-
From: Arthur Barstow [mailto:art.bars...@nokia.com] 
Sent: Monday, April 16, 2012 4:44 AM
To: public-webapps
Subject: CfC: publish LCWD of Server-sent Events; deadline April 23

The Server-sent Events spec has three open bugs:

* 14900 - suggests adding an origin warning check
* 15495 - generic comment re Web platform (not really SSE specific)
* 16070 - request for additional reference

I don't see any of these bug as important enough to block LC so this is 
a Call for Consensus to publish a new LCWD with these bugs open, using 
the latest ED as the basis http://dev.w3.org/html5/eventsource/.

This CfC satisfies the group's requirement to record the group's 
decision to request advancement for this LCWD. Note the Process 
Document states the following regarding the significance/meaning of a LCWD:

[[
http://www.w3.org/2005/10/Process-20051014/tr.html#last-call

Purpose: A Working Group's Last Call announcement is a signal that:

* the Working Group believes that it has satisfied its relevant 
technical requirements (e.g., of the charter or requirements document) 
in the Working Draft;

* the Working Group believes that it has satisfied significant 
dependencies with other groups;

* other groups SHOULD review the document to confirm that these 
dependencies have been satisfied. In general, a Last Call announcement 
is also a signal that the Working Group is planning to advance the 
technical report to later maturity levels.
]]

If you have any comments or concerns about this CfC, please send them to 
public-webapps@w3.org by April 23 at the latest. Positive response is 
preferred and encouraged and silence will be assumed to be agreement 
with the proposal.

-Thanks, AB





RE: publish Proposed Recommendation of Widget Interface; deadline April 26

2012-04-22 Thread SULLIVAN, BRYAN L
Art,

I support the publication as PR.

Thanks,
Bryan Sullivan

-Original Message-
From: Arthur Barstow [mailto:art.bars...@nokia.com] 
Sent: Thursday, April 19, 2012 6:50 AM
To: public-webapps
Subject: CfC: publish Proposed Recommendation of Widget Interface; deadline 
April 26

Now that the normative references for the Widget Interface spec have 
advanced and we have documented the spec only uses stable features of 
HTML5 [1], the Widget Interface is ready for publication as a Proposed 
Recommendation. As such, this is Call for Consensus to publish a PR of 
this spec using the following ED as the basis:

http://dev.w3.org/2006/waf/widgets-api/

Note the Process Document includes the following regarding the entrance 
criteria for a PR and the WG's requirements:

[[
http://www.w3.org/2005/10/Process-20051014/tr.html#cfr

* Shown that each feature of the technical report has been implemented. 
Preferably, the Working Group SHOULD be able to demonstrate two 
interoperable implementations of each feature.
]]

As documented in this spec's CR [2], the CR exit criteria was met before 
the CR was published.

If you have any comments about this proposal, please send them to 
public-webapps@w3.org by April 26 at the latest. Positive response is 
preferred and encouraged and silence will be considered as agreeing with 
the proposal.

-AB

[1] http://lists.w3.org/Archives/Public/public-webapps/2012AprJun/0246.html
[2] http://www.w3.org/TR/2011/CR-widgets-apis-20111213/






RE: publish Candidate Recommendation of HTML5 Web Messaging; deadline April 11

2012-04-04 Thread SULLIVAN, BRYAN L
I support the publication as a CR.

Thanks,
Bryan Sullivan

From: Arthur Barstow [mailto:art.bars...@nokia.com]
Sent: Wednesday, April 04, 2012 7:07 AM
To: public-webapps
Subject: CfC: publish Candidate Recommendation of HTML5 Web Messaging; deadline 
April 11

During the comment period for the March 13 LCWD of HTML5 Web Messaging, no 
comments were submitted nor were any new bugs filed. This spec's bug list 
contains the same bug that was present when the CfC for LC was started (13686 
which is a request for a non-normative example). The latest ED - which will be 
the basis for the CR - has changed since the LC was published but my analysis 
of the diffs indicated that no normative changes have been made.

As such, this is a CfC to publish a Candidate Recommendation of HTML5 Web 
Messaging using the latest ED as the basis:

   http://dev.w3.org/html5/postmsg/

I propose the CR's exit criteria be the same as that used by Web Storage (and 
Web Sockets):

  http://www.w3.org/TR/webstorage/#crec

This CfC satisfies: a) the group's requirement to record the group's decision 
to request advancement to CR; and b) General Requirements for Advancement on 
the Recommendation Track as defined in the Process Document:

 http://www.w3.org/2005/10/Process-20051014/tr.html#transition-reqs

Positive response to this CfC is preferred and encouraged and silence will be 
considered as agreeing with the proposal. The deadline for comments is April 11 
and all comments should be sent to public-webapps.

-Thanks, AB



RE: publish Candidate Recommendation of Web Workers; deadline April 11

2012-04-04 Thread SULLIVAN, BRYAN L
I support the publication as a CR.

Thanks,
Bryan Sullivan

From: Arthur Barstow [mailto:art.bars...@nokia.com]
Sent: Wednesday, April 04, 2012 6:45 AM
To: public-webapps
Subject: CfC: publish Candidate Recommendation of Web Workers; deadline April 11

During the comment period for the March 13 LCWD of Web Workers, no comments 
were submitted nor were any new bugs filed. The Worker bug list contains the 
same 2 bugs that were present when the CfC for LC was started (14086 which is 
marked as an enhancement and 14214 which is editorial). The latest ED - which 
will be the basis for the CR - has changed since the LC was published but my 
analysis of the diffs indicated that no normative changes have been made.

As such, this is a CfC to publish a Candidate Recommendation of Web Workers 
using the latest ED as the basis:

  http://dev.w3.org/html5/workers/

I propose the CR's exit criteria be the same as that used by Web Storage (and 
Web Sockets):

  http://www.w3.org/TR/webstorage/#crec

This CfC satisfies: a) the group's requirement to record the group's decision 
to request advancement to CR; and b) General Requirements for Advancement on 
the Recommendation Track as defined in the Process Document:

 http://www.w3.org/2005/10/Process-20051014/tr.html#transition-reqs

Positive response to this CfC is preferred and encouraged and silence will be 
considered as agreeing with the proposal. The deadline for comments is April 11 
and all comments should be sent to public-webapps.

-Thanks, AB




RE: Regarding app notification and wake up

2012-03-12 Thread SULLIVAN, BRYAN L
Karl, excellent questions.

Re (1), there are various systems of device addressing in use today, largely 
dependent upon the notification delivery system. An assumption to start with is 
that barring any optimizations which enable seamless switching between SSE 
connections and connectionless delivery (which requires a delivery agent/client 
on the device, feasible but still an optimization - we can table that for now, 
in this discussion), is that the webapp coordinates whatever 
connectionless/shared delivery system is to be used along with the appropriate 
addressing scheme and address, with the webapp server prior to the switch (or 
in the setup of the original connection). Without getting too deep in to 
specific system designs I can say that this does work and can demo the concept 
pretty soon (I'm implementing a demo now).

Re (2), since the webapp creates a specific eventsource object (using SSE as 
the model), there is a direct thread back to it from the user agent. What is 
needed for the user agent to deliver only the specific events that the webapp 
desires, is that there needs to be some filter criteria that is negotiated with 
the webapp server (or delivery system) e.g. as part of the original eventsource 
object creation. In OMA Push, we have an Application ID header that is used for 
this purpose (it can carry any arbitrary value, and be used by the user agent 
or a local Push Client to filter out events other than those desired). Webapps 
can also use any arbitrary application-layer data to filter or apply trust to 
incoming events, but this is a convenient thing to do by a UA or Push Client 
and that's why we included that in the OMA Push design. Other notification 
delivery systems probably have similar features. The goal is not however to 
reference delivery-system specific features directly in the W3C API, but to 
describe how such app addressability is possible in general, and at most to all 
generic filter criteria mechanisms to the API (e.g. this header equals that 
value, or more generically this token is present with that value).

Re (3), I think the web authentication system (same-origin policy and CORS) is 
strong enough for what is needed here. Beyond that, apps can use any high-order 
security for authentication/authorization tokens to be included in the 
application data or as headers (in delivery systems that follow the HTTP 
header+body model, ala OMA Push).

There's probably a lot in the above statements that need to be unpacked in more 
detail. That's why we proposed this for the charter update. We have been 
involved in Push-based enabler and service design since pre-2000, and with that 
background I think we have a good foundation to resolve the questions you noted.

Thanks,
Bryan Sullivan

-Original Message-
From: Karl Dubost [mailto:ka...@opera.com] 
Sent: Monday, March 12, 2012 2:04 PM
To: SULLIVAN, BRYAN L
Cc: Ian Hickson; Stefan Hakansson LK; public-webapps@w3.org
Subject: Re: Regarding app notification and wake up


Le 9 mars 2012 à 19:43, SULLIVAN, BRYAN L a écrit :
 This is different from the earlier discussion on extending SSE to 
 connectionless event sources, as there's no assumption the Webapp is running 
 in this case. If the Webapp *is* running, it's within the scope of what we 
 have discussed earlier as SSE extensions (and not technically a wakeup).

If I understood the use case, it means that 

1. the device is addressable (except for customers with a subscription to a 
Mobile Operator, not sure how we would do that. Any ideas? Maybe on local 
network that would be feasible but doesn't answer the use case it seems.)
2. the software is addressable (more than one software able to process a 
specific request. Think about Opera and Firefox on the same device.)
3. that also requires a strong authentication system

I can see the appeal, but I balance it with spam at large scale too.
The UX model of SSE is that the user is still initiating the call.

Related to the initial mail
http://lists.w3.org/Archives/Public/public-webapps/2012JanMar/0008
http://bkaj.net/w3c/eventsource-push.html




-- 
Karl Dubost - http://dev.opera.com/
Developer Relations, Opera Software




RE: Regarding app notification and wake up

2012-03-09 Thread SULLIVAN, BRYAN L
What WebRTC needs is related to the use cases I submitted for the  Webapps 
charter update, for a Push API (based upon the concept presented at TPAC). 
Without presuming any implementation details at this point (even whether 
EventSource as it stands will fulfill this), we need the ability of Webapps to 
register for events to be delivered whether the Webapp (or even the user agent) 
is running or not. This will ensure that the Webapp does not have to maintain 
an always-on connection in order to receive incoming call notifications (or 
other types of notifications).

This is a capability with broad utility, and we have been discussing the 
possibilities in W3C and beyond for several years. The first discussion in W3C 
was at the 2009 TPAC where I presented the concept for Connectionless Push to 
the HTML WG, with the result that the Server-Sent Events spec section on 
Connectionless Push was updated its current - although still informative - 
text. I have been leading work in other areas (e.g. the OMA and OMTP/WAC) on 
this API design, and in bringing the design ideas to Webapps in TPAC 2012 it 
was agreed in principle that work on such an API would be considered in the 
Webapps rechartering, given that it would be possible to bind to any underlying 
delivery system (whether standardized e.g. SMS, OMA Push, or other proprietary 
connectionless Push capabilities).

On EventSource specifically, I believe its design can in principle be used to 
attach to event notification services independent of whether the actual 
over-the-air/wire protocol (bearer) at use at any one time is 
connection-oriented (e.g. HTTP as in typical SSE) or otherwise. This is the 
approach we have taken in OMA in defining the Push API which is nearing its 
final specification stage, and is based purely in SSE (and as a deployment 
option, transparently to the user agent). But while binding to specific bearers 
may be an implementation detail (there will be specific behaviors that will 
need to be implemented by the user-agent), there are some aspects that will 
need to be considered by the user agent which go beyond the current SSE spec, 
e.g.
- persistent eventsource objects, i.e. creation of an eventsource (or something 
with the same general semantics) that exists whether the Webapp is running or 
not
- ability of the user agent to invoke the Webapp when an event arrives, and the 
Webapp or the user agent itself is not running
- binding of the incoming event data to the text/event-stream processing model 
used in eventsource
- etc

In considering these things, we may determine that SSE is not in fact the best 
match for this goal in W3C, but that's part of the proposed discussion in 
Webapps.

Thanks,
Bryan Sullivan
-Original Message-
From: Scott Wilson [mailto:scott.bradley.wil...@gmail.com] 
Sent: Friday, March 09, 2012 6:35 AM
To: Stefan Hakansson LK
Cc: public-webapps@w3.org
Subject: Re: Regarding app notification and wake up


On 9 Mar 2012, at 08:10, Stefan Hakansson LK wrote:

 The webrtc WG has identified that the ability to notify, and possibly wake 
 up, a web application of incoming events is important. This to enable support 
 of use cases such as incoming calls. And in certain scenarios the resource 
 use (e.g. power) is very important.
 
 However, this kind of functionality is not in scope of the webrtc WG, but 
 seems to belong to the Web Applications WG. So this is a message that the 
 webrtc WG is interested in seeing technology that supports this being 
 developed. We have also noted discussions in Web Apps around use cases for 
 connection-less push: 
 http://lists.w3.org/Archives/Public/public-webapps/2012JanMar/0008.html - 
 especially the third one is very relevant for us.
 
 Stefan and Harald (chairs) for the webrtc WG.
 

Could server-sent events[1] meet this requirement?

[1] http://dev.w3.org/html5/eventsource/



RE: Regarding app notification and wake up

2012-03-09 Thread SULLIVAN, BRYAN L
Ian,

Stefan may respond with more detail, but the use cases we submitted for WebRTC 
consideration describe this as the ability to invoke an application and pass an 
event to it, whether it is running (or not) at the time of the event reception 
by the device. By running I mean that the app, or its user agent (in the case 
of a web app executing under a user agent), are not currently executing on the 
device, in any state. This wake up and deliver capability may require a 
multi-step device-internal process, but the overall goal covers both actions.

Thanks,
Bryan Sullivan

-Original Message-
From: Ian Hickson [mailto:i...@hixie.ch] 
Sent: Friday, March 09, 2012 4:09 PM
To: Stefan Hakansson LK
Cc: public-webapps@w3.org
Subject: Re: Regarding app notification and wake up

On Fri, 9 Mar 2012, Stefan Hakansson LK wrote:

 The webrtc WG has identified that the ability to notify, and possibly 
 wake up, a web application of incoming events is important. This to 
 enable support of use cases such as incoming calls. And in certain 
 scenarios the resource use (e.g. power) is very important.

What exactly do you mean by wake up?

-- 
Ian Hickson   U+1047E)\._.,--,'``.fL
http://ln.hixie.ch/   U+263A/,   _.. \   _\  ;`._ ,.
Things that are impossible just take longer.   `._.-(,_..'--(,_..'`-.;.'




RE: Regarding app notification and wake up

2012-03-09 Thread SULLIVAN, BRYAN L
Yes, or more specifically (if this matters) invoke a Webapp, which at some 
level relates to a page as its root.

This is different from the earlier discussion on extending SSE to 
connectionless event sources, as there's no assumption the Webapp is running in 
this case. If the Webapp *is* running, it's within the scope of what we have 
discussed earlier as SSE extensions (and not technically a wakeup).

Thanks,
Bryan Sullivan

-Original Message-
From: Ian Hickson [mailto:i...@hixie.ch] 
Sent: Friday, March 09, 2012 4:39 PM
To: SULLIVAN, BRYAN L
Cc: Stefan Hakansson LK; public-webapps@w3.org
Subject: RE: Regarding app notification and wake up

On Sat, 10 Mar 2012, SULLIVAN, BRYAN L wrote:
 
 Stefan may respond with more detail, but the use cases we submitted for 
 WebRTC consideration describe this as the ability to invoke an 
 application and pass an event to it, whether it is running (or not) at 
 the time of the event reception by the device. By running I mean that 
 the app, or its user agent (in the case of a web app executing under a 
 user agent), are not currently executing on the device, in any state. 
 This wake up and deliver capability may require a multi-step 
 device-internal process, but the overall goal covers both actions.

So basically you're saying you want to remotely cause a Web browser to 
load a Web page?

-- 
Ian Hickson   U+1047E)\._.,--,'``.fL
http://ln.hixie.ch/   U+263A/,   _.. \   _\  ;`._ ,.
Things that are impossible just take longer.   `._.-(,_..'--(,_..'`-.;.'



RE: ACTION-568: Create an alternative mechanism for openURL andsend it to the mail list (Web Applications Working Group)

2010-08-10 Thread SULLIVAN, BRYAN L (ATTCINW)
If the linked location is outside the widget package, it should not 
automatically load in the browser. We need the ability of widgets to download 
and present network-based content through means other than XHR or iframes. If 
my widget is designed to ingest and present content from external sources 
(declared as per WARP) within its context (and not just within an iframe), 
causing such external references to launch in the browser will prevent the 
intended operation of the widget.

Thanks, 
Bryan Sullivan | ATT


-Original Message-
From: Marcos Caceres [mailto:marc...@opera.com] 
Sent: Tuesday, August 10, 2010 12:30 AM
To: gaut...@opera.com; SULLIVAN, BRYAN L (ATTCINW)
Cc: Web Applications Working Group WG
Subject: Re: ACTION-568: Create an alternative mechanism for openURL andsend it 
to the mail list (Web Applications Working Group)



On 8/10/10 9:03 AM, gaut...@opera.com wrote:
 Quoting SULLIVAN, BRYAN L (ATTCINW) bs3...@att.com:

 Marcos,
 You're saying if I understand you, that if I create an anchor:

 a href=http://mywidget.com;Click to load the online version/a

 That when the user clicks this link it will launch the browser,
 instead of retrieving the online version of my widget (or at least of
 this page of it)? This would in essence prevent the use of anchors
 anywhere in widgets, where the developer's intent was to have the web
 runtime retrieve and present the content directly, within the widget's
 context. For example, if I want to use an iframe to pull in some
 external content and then allow the user to navigate the content
 within the iframe - in your proposal the first link they hit in the
 iframe would take them out of the widget and into the browser. Not the
 desired experience IMO.

 Or do I misunderstand your proposal?

Hi Bryan, inline content (iframe, img, etc.) inclusion is not affected 
by the proposal. It's perfectly fine to have the following...

Opens in new window:
a href=http://foo.com;foo/a
a href=tel:+12312Call foo/a

Relative link, open in widget context:
a href=bar.htmlbar/a

Embeds in page, if allowed by WARP:
iframe src=http://foo.com;/iframe


 I think the proposal is missing explicit meaning for target=_self and
 _blank
 (something I'm sure Marcos has considered, maybe just not clarified.)

 a href=http://www.mywidget.com/;click here/a

 If the linked location is inside the widget package, or
 sms:/tel:/similar protocols that don't need a browsing context, I would
 expect:
 - it to load in target=_self (ie. the widget)

Right. This is/would-be defined in HTML5.

 If the linked location is outside the widget package, I would expect:
 - it to load in target=_blank (ie. the browser)

As above.

 If a specific rule must be followed, the developer must add target=_self
 or _blank depending on where the resource must be opened, for example.
 Loading a widget link from inside a widget, or for initiating a download
 - target=_self could be explicitly used.


 Marcos, please correct me if I'm reading too much into your proposal.

You are reading it just fine; But your clarifications are outside the 
scope of the Widget Interface spec.


-- 
Marcos Caceres
Opera Software


RE: ACTION-568: Create an alternative mechanism for openURL and send it to the mail list (Web Applications Working Group)

2010-08-09 Thread SULLIVAN, BRYAN L (ATTCINW)
Marcos,
That method works for well-know URI schemes except for http:// and https://. 
The openURL() method would have launched the browser for those schemes, and we 
still need a method to do that. 

I was not able to attend the last week's call and was not aware there was a 
plan to remove the openURL() method. This leaves a major hole in the 
functionality we need from the Widgets specs (ability to launch the browser 
when necessary/desirable, which is something only known by the widget - e.g. it 
needs to invoke a resource that it knows needs to be handled through the 
browser or other registered URI scheme handler).

Thanks, 
Bryan Sullivan | ATT

-Original Message-
From: public-webapps-requ...@w3.org [mailto:public-webapps-requ...@w3.org] On 
Behalf Of Marcos Caceres
Sent: Friday, August 06, 2010 8:56 AM
To: Web Applications Working Group WG
Subject: Re: ACTION-568: Create an alternative mechanism for openURL and send 
it to the mail list (Web Applications Working Group)



On 8/5/10 3:30 PM, Web Applications Working Group Issue Tracker wrote:

 ACTION-568: Create an alternative mechanism for openURL and send it to the 
 mail list (Web Applications Working Group)

 http://www.w3.org/2008/webapps/track/actions/568

 On: Marcos Caceres
 Due: 2010-08-12

 If you do not want to be notified on new action items for this group, please 
 update your settings at:
 http://www.w3.org/2008/webapps/track/users/39125#settings

The proposal is simply to use HTML a element.

So, instead of:
   widget.openURL(sms:+123456789101112);

It would just be:
  a href=sms:+123456789101112Send and SMS/a

Then you can use the .click() element to open links programmatically (on 
trusted URI types) or only respond to explicit user interaction (the 
user clicks on the link to do something).

Kind regards,
Marcos


-- 
Marcos Caceres
Opera Software



RE: [XHR] Status Update

2010-08-09 Thread SULLIVAN, BRYAN L (ATTCINW)
Anne,

Are you saying that it should not be possible now (with XHR L1) to
receive HTML files via XHR (Receiving HTML documents would indeed be a
newish feature ) ?

This does actually work for me in XHR L1, so I'm unclear about what you
mean below.

Thanks, 
Bryan Sullivan | ATT


-Original Message-
From: public-webapps-requ...@w3.org
[mailto:public-webapps-requ...@w3.org] On Behalf Of Anne van Kesteren
Sent: Monday, August 09, 2010 1:25 PM
To: Jonas Sicking
Cc: WebApps WG
Subject: Re: [XHR] Status Update

On Mon, 09 Aug 2010 20:54:48 +0200, Jonas Sicking jo...@sicking.cc
wrote:
 Some of these bugs are feature enhancements. Such as adding support
 for sending and receiving text/html documents. In the interest of
 getting us to rec as quickly as possible I suggest that these features
 are added to XHR L2 instead.

Actually, by virtue of following the Document.innerHTML algorithm from  
HTML5 sending HTML documents is already covered for in XMLHttpRequest.
It  
is just that the media type (as the bug indicates) is always set to  
application/xml rather than text/html for HTML documents.

Receiving HTML documents would indeed be a newish feature, except that
you  
already need to follow HTML5 rules to discover the character encoding
for  
responseText, etc. so adding this did not seem like a big burden on  
implementations on top of which it makes sense that if you can send them

(which was already possible) you can also receive them.

You say such as but I believe these are the only two bugs that can be

classified as such and the former is really a bug and not a new feature.


-- 
Anne van Kesteren
http://annevankesteren.nl/




RE: ACTION-568: Create an alternative mechanism for openURL andsend it to the mail list (Web Applications Working Group)

2010-08-09 Thread SULLIVAN, BRYAN L (ATTCINW)
Marcos,
You're saying if I understand you, that if I create an anchor:

a href=http://mywidget.com;Click to load the online version/a

That when the user clicks this link it will launch the browser, instead of 
retrieving the online version of my widget (or at least of this page of it)? 
This would in essence prevent the use of anchors anywhere in widgets, where the 
developer's intent was to have the web runtime retrieve and present the content 
directly, within the widget's context. For example, if I want to use an iframe 
to pull in some external content and then allow the user to navigate the 
content within the iframe - in your proposal the first link they hit in the 
iframe would take them out of the widget and into the browser. Not the desired 
experience IMO.

Or do I misunderstand your proposal?

Thanks, 
Bryan Sullivan | ATT


-Original Message-
From: marc...@opera.com [mailto:marc...@opera.com] 
Sent: Monday, August 09, 2010 2:51 PM
To: SULLIVAN, BRYAN L (ATTCINW)
Cc: Web Applications Working Group WG
Subject: RE: ACTION-568: Create an alternative mechanism for openURL andsend it 
to the mail list (Web Applications Working Group)

Quoting SULLIVAN, BRYAN L (ATTCINW) bs3...@att.com:

 Marcos,
 That method works for well-know URI schemes except for http:// and   
 https://. The openURL() method would have launched the browser for   
 those schemes, and we still need a method to do that.


No.  We dont. Please see my proposal.

 I was not able to attend the last week's call and was not aware   
 there was a plan to remove the openURL() method. This leaves a major  
  hole in the functionality we need from

Major hole?  No one has yet presented a single use case that could not  
be done with an a element.

the Widgets specs (ability to
 launch the browser when necessary/desirable, which is something only  
  known by the widget - e.g. it needs to invoke a resource that it   
 knows needs to be handled through the browser or other registered   
 URI scheme handler).

See my proposal. Its not needed.


 Thanks,
 Bryan Sullivan | ATT

 -Original Message-
 From: public-webapps-requ...@w3.org   
 [mailto:public-webapps-requ...@w3.org] On Behalf Of Marcos Caceres
 Sent: Friday, August 06, 2010 8:56 AM
 To: Web Applications Working Group WG
 Subject: Re: ACTION-568: Create an alternative mechanism for openURL  
  and send it to the mail list (Web Applications Working Group)



 On 8/5/10 3:30 PM, Web Applications Working Group Issue Tracker wrote:

 ACTION-568: Create an alternative mechanism for openURL and send it  
  to the mail list (Web Applications Working Group)

 http://www.w3.org/2008/webapps/track/actions/568

 On: Marcos Caceres
 Due: 2010-08-12

 If you do not want to be notified on new action items for this   
 group, please update your settings at:
 http://www.w3.org/2008/webapps/track/users/39125#settings

 The proposal is simply to use HTML a element.

 So, instead of:
widget.openURL(sms:+123456789101112);

 It would just be:
   a href=sms:+123456789101112Send and SMS/a

 Then you can use the .click() element to open links programmatically (on
 trusted URI types) or only respond to explicit user interaction (the
 user clicks on the link to do something).

 Kind regards,
 Marcos


 --
 Marcos Caceres
 Opera Software







RE: [XHR] Status Update

2010-08-09 Thread SULLIVAN, BRYAN L (ATTCINW)
Well at least it works in Firefox, Safari, Opera, and Chrome.

With that broad support, I imagine that removing this defacto feature in
XHR L2 would cause a lot of heartburn for developers who probably rely
upon it today.

Thanks, 
Bryan Sullivan | ATT
-Original Message-
From: Anne van Kesteren [mailto:ann...@opera.com] 
Sent: Monday, August 09, 2010 2:49 PM
To: Jonas Sicking; SULLIVAN, BRYAN L (ATTCINW)
Cc: WebApps WG
Subject: Re: [XHR] Status Update

On Mon, 09 Aug 2010 23:37:25 +0200, SULLIVAN, BRYAN L (ATTCINW)  
bs3...@att.com wrote:
 Are you saying that it should not be possible now (with XHR L1) to
 receive HTML files via XHR (Receiving HTML documents would indeed be
a
 newish feature ) ?

 This does actually work for me in XHR L1, so I'm unclear about what
you
 mean below.

It is not supported by the specification as it stands today, no, and
never  
was, and is not supported by all implementations. However, I think we  
should add it, as I explained in my previous email.


-- 
Anne van Kesteren
http://annevankesteren.nl/



RE: [XHR] Status Update

2010-08-09 Thread SULLIVAN, BRYAN L (ATTCINW)
Jonas,

With the code below, I have no problem doing this in Firefox. Notes:
- asyncXHR is a typical XHR wrapper function, not included here for
brevity.
- The key statement below is:
document.getElementById(text).innerHTML = Headers:br +
hdrs + br/ + xhr.responseText;
With this, Firefox correctly renders the retrieved HTML content
into the element text.

function gotResponse(xhr) {
var extref = document.getElementById(extref);
extref.innerHTML = ;  
extref.setAttribute('src', );
var hdrs = xhr.getAllResponseHeaders();
var type = xhr.getResponseHeader(Content-Type);
if (type === text/plain) {
document.getElementById(text).innerHTML =
Headers:br + hdrs + br/pre + xhr.responseText + /pre;
}
else {
document.getElementById(text).innerHTML =
Headers:br + hdrs + br/ + xhr.responseText;
}
}

function loadFile(url,inline) {
var encurl = encodeURI(url);
if (inline) {
document.getElementById(text).innerHTML = loadFile: 
+ url;
asyncXHR('GET',encurl,,'*/*',,gotResponse);
}
else {
var extref = document.getElementById(extref);
document.getElementById(text).innerHTML = loadFile: 
+ url + brFile should appear below;
extref.setAttribute('src', encurl); 
}
}

Thanks, 
Bryan Sullivan | ATT


-Original Message-
From: Jonas Sicking [mailto:jo...@sicking.cc] 
Sent: Monday, August 09, 2010 5:23 PM
To: SULLIVAN, BRYAN L (ATTCINW)
Cc: Anne van Kesteren; WebApps WG
Subject: Re: [XHR] Status Update

On Mon, Aug 9, 2010 at 5:13 PM, SULLIVAN, BRYAN L (ATTCINW)
bs3...@att.com wrote:
 Well at least it works in Firefox, Safari, Opera, and Chrome.

 With that broad support, I imagine that removing this defacto feature
in
 XHR L2 would cause a lot of heartburn for developers who probably rely
 upon it today.

This is not correct. I can't speak for the other browsers, but Firefox
does not support loading HTML documents using XMLHttpRequest. We never
hook up any other type of parser than an XML parser. And if the
Content-Type of the response is text/html we don't hook up any
parser at all.

/ Jonas



RE: [XHR] Status Update

2010-08-09 Thread SULLIVAN, BRYAN L (ATTCINW)
Sorry, the statement  Receiving HTML documents would indeed be a newish
feature  implied that it was not possible at all - if it is possible at
least using responseText (which it clearly is), and just dumping the
text into an element allows it to be accessed via the DOM, then for my
purposes it is supported.

Thanks for the clarification.

Thanks, 
Bryan Sullivan | ATT


-Original Message-
From: Anne van Kesteren [mailto:ann...@opera.com] 
Sent: Monday, August 09, 2010 9:51 PM
To: Jonas Sicking; SULLIVAN, BRYAN L (ATTCINW)
Cc: WebApps WG
Subject: Re: [XHR] Status Update

On Tue, 10 Aug 2010 05:19:10 +0200, SULLIVAN, BRYAN L (ATTCINW)  
bs3...@att.com wrote:
 With the code below, I have no problem doing this in Firefox.

That code is not using responseXML...


-- 
Anne van Kesteren
http://annevankesteren.nl/



RE: Transferring File* to WebApps - redux

2010-06-18 Thread SULLIVAN, BRYAN L (ATTCINW)
Eric,
Based upon your responses there are a couple of additional things we
need to check on, but I'll look deeper into the current specs for the
things that should already be supported.

The additional things are:

- how to safely grant access outside the sandbox, which depends upon
ability to discover available file systems in persistent storage and
select arbitrary locations within them. We would prefer that this
functional capability is addressed within the File* APIs directly rather
than through an extension API in DAP, thus we may propose two additional
methods for the LocalFilesystem interface:
   getDefaultLocation: as from
http://bondi.omtp.org/1.1/apis/filesystem.html#getDefaultLocationN101E4 
   getRootLocations: as from
http://bondi.omtp.org/1.1/apis/filesystem.html#getRootLocationsN10253 
These methods can be covered under the general one-time prompt approach
or under the policy approach (once we have worked out how the File* APIs
are covered under that, e.g. by association of widget feature URIs).

- clarify the difference between memory and persistent storage: In
memory usually means the content is in the working RAM of a device. The
File* specs talk about working with files in memory which I take to
mean that the file has been read from persistent storage into the
working memory of the browser (upon selection by the user), and is being
read or updated (with presumed writing back to persistent storage
later). The different may be subtle but is important. If what's meant
instead of a file copy in memory is that the webapp can *directly*
access/update a file in persistent storage, then I suggest the spec
terminology be updated to make that clear. 

Thanks, 
Bryan Sullivan | ATT


-Original Message-
From: Eric Uhrhane [mailto:er...@google.com] 
Sent: Wednesday, June 16, 2010 4:42 PM
To: SULLIVAN, BRYAN L (ATTCINW)
Cc: a...@mozilla.com; Robin Berjon; public-device-a...@w3.org; Ian
Fette; Web Applications Working Group WG
Subject: Re: Transferring File* to WebApps - redux

Sorry about the delay in response; I've been out of the office for the
past 10 days.  [Also, sorry Bryan--I forgot to reply-all.]

On Tue, Jun 15, 2010 at 3:24 PM, SULLIVAN, BRYAN L (ATTCINW)
bs3...@att.com wrote:
 I am not meaning to be unfair, perhaps the message is not coming
through
 clearly enough.

 There are specific technical requirements that we need these APIs to
 fulfill, that I indicated to Thomas in another email:
 1) access filesystems on the host device

FileSystem/FileWriter/FileReader do this.

 2) traverse directories

FileSystem does this.  Currently it's only specced to do so within a
per-origin sandbox, but the API could be used outside the sandbox if
another spec defined a mechanism to grant such access safely.

 3) read files as they exist on the filesystem (not just a local
 representation in memory, as currently defined in the File API to my
 understanding), in bytes and lines

FileReader does this [not sure what you mean about a local
representation--if you can read an on-disk file, you're doing so via
memory].

 4) write files (similar requirement to write directly to the
 filesystem), in bytes and lines, with overwrite and append options

FileSystem/FileWriter do this [details of appending still being hammered
out].

 5) do the above programmatically in Javascript (not dependent just
upon
 user selection of an input element and interaction with a file
selector)

FileSystem does this.  And no, there's no need for the UA to prompt
the user on each access; permissions should be more on the order of
can access temporary filesystem storage and can access persistent
filesystem storage, and need only be granted once.

 6) provide security for this using the policy-framework approach as
 being defined for DAP APIs

This remains for DAP to work out.  It should be fairly straightforward
to add a policy-based mechanism to grant access to FileSystem APIs
[e.g. your example documents folder, via resolveLocalFilesystemURI,
mentioned elsewhere in this thread].

Thanks,

Eric



RE: Transferring File* to WebApps - redux

2010-06-15 Thread SULLIVAN, BRYAN L (ATTCINW)
Arun,

The basic concern I have is with the notion of browsers as the only
Web context and use-case that matters. The browser-based model for API
integration view (as I understand your position) is that the user must
be actively involved in every significant action, and choose explicitly
the actions that enable integration with browser-external resources
(including local and remote). Step back and you will see the
inconsistency in that (what would Ajax be if the user had to approved
every HTTP API request via an input element?).

Webapps are much more than just dynamic Web pages. They are
applications, and with HTML5 will have the ability to rival desktop
applications, as is clearly the vision of many in the industry. It might
even enable a return to a thin client world (e.g. browser as OS) in
which most significant resources are cloud-based. I see the logic and
value in that, but it's not the only valid (and valuable) model.

W3C focuses on the Web, and the Web is bigger than the browser use-case.
HTML5 and the APIs that attach HTML-based applications to the world can
actually be the application platform for the next era of the Web, but
only if we do not limit the options to the user-centric/control
paradigms of the past.

Thanks, 
Bryan Sullivan | ATT


-Original Message-
From: Arun Ranganathan [mailto:a...@mozilla.com] 
Sent: Tuesday, June 15, 2010 1:48 PM
To: SULLIVAN, BRYAN L (ATTCINW)
Cc: Robin Berjon; public-device-a...@w3.org; Ian Fette; Web Applications
Working Group WG
Subject: Re: Transferring File* to WebApps - redux

On 6/15/10 1:15 PM, SULLIVAN, BRYAN L (ATTCINW) wrote:
 We would not be in favor of this transfer. We believe this API needs
to
 be developed in the DAP group, as our vision for its functionality was
 driven by the input from BONDI and in general as a *device* API (as
 compared to an abstracted API for cloud-based file resources), and we
do
 not believe that vision will be fulfilled if this work is transferred
to
 Webapps.


The BONDI API isn't a good starting place for an API that can be built 
into web browsers, since it doesn't gracefully layer into the existing 
HTML input element model for file selection.  You are making a 
distinction I don't understand clearly, since we're not really 
considering cloud-based file resources with the FileReader API.  
Rather, we are considering file resources resident on the device.  The 
API allows you to select them using an input element, and then access 
the file resource and programmatically manipulate it as a Blob.  
Similarly, the FileWriter API allows you to use the save as channel to

write to the device in question.  The FileSystem specification posits an

abstraction that isn't necessarily cloud-based (although FWIW that is 
also possible).

If you have a different vision, then that vision is incompatible with 
web browsers.  In this case, I'd encourage the DAP WG, which *also* has 
a charter to work on file system deliverables, to construct an API which

matches the use case you have in mind.  You may then pursue the relevant

BONDI API, which as a browser vendor I cannot consider.

 If the issue is the level of discussion in this group, that can be
 addressed. For one, I have seen quite a lot of traffic on the DAP
email
 list about this, so I don't understand the question of activity.


If you note the discussion on FileWriter, you'll see that the lion's 
share of feedback comes from cross-posts to public-weba...@w3.org.  
Feedback from others, including those that post to the DAP WG, is always

welcome.
 But to start, I will address some of the open topics in the current
 draft on the DAP list, to help get the discussion moving faster.



Again, I'd urge you to reconsider your position.  The move of the 
specification in question -- FileWriter and FileSystem -- allows for 
greater collaboration on the same web stack, *and* allows parties that 
are NOT members of the DAP WG to comment on the technology.  Perhaps you

are misunderstanding the goals here?  Or, perhaps you can provide a 
tighter definition of what you mean by cloud-based file resources 
*exactly*?  DAP WG members are, by charter, free to consider technology 
that matches their particular use case.

-- A*




RE: Transferring File* to WebApps - redux

2010-06-15 Thread SULLIVAN, BRYAN L (ATTCINW)
Jonas,
I guess there might be a parting of the ways here, resulting from
differing (I guess some would say, incompatible) use cases and the APIs
that support them. 

If the current File APIs in DAP are expected to only serve the
user-centric browser paradigm then I agree they will not meet the DAP
requirements and could be finalized in Webapps. But in DAP we will still
need to define an API that *does* meet the use cases and requirements as
envisioned in BONDI (which are focused more on mobile use cases and
security models, as compared to a desktop browser focus) and that are
now being carried forward in the WAC. 

So to help move us forward with the use cases that matter most to us in
DAP, ATT will draft a new API (filesystem) and provide that as input to
the upcoming DAP F2F.

Thanks, 
Bryan Sullivan | ATT


-Original Message-
From: Jonas Sicking [mailto:jo...@sicking.cc] 
Sent: Tuesday, June 15, 2010 2:48 PM
To: SULLIVAN, BRYAN L (ATTCINW)
Cc: a...@mozilla.com; Robin Berjon; public-device-a...@w3.org; Ian
Fette; Web Applications Working Group WG
Subject: Re: Transferring File* to WebApps - redux

On Tue, Jun 15, 2010 at 2:24 PM, SULLIVAN, BRYAN L (ATTCINW)
bs3...@att.com wrote:
 Arun,

 The basic concern I have is with the notion of browsers as the only
 Web context and use-case that matters. The browser-based model for API
 integration view (as I understand your position) is that the user must
 be actively involved in every significant action, and choose
explicitly
 the actions that enable integration with browser-external resources
 (including local and remote). Step back and you will see the
 inconsistency in that (what would Ajax be if the user had to approved
 every HTTP API request via an input element?).

 Webapps are much more than just dynamic Web pages. They are
 applications, and with HTML5 will have the ability to rival desktop
 applications, as is clearly the vision of many in the industry. It
might
 even enable a return to a thin client world (e.g. browser as OS) in
 which most significant resources are cloud-based. I see the logic and
 value in that, but it's not the only valid (and valuable) model.

 W3C focuses on the Web, and the Web is bigger than the browser
use-case.
 HTML5 and the APIs that attach HTML-based applications to the world
can
 actually be the application platform for the next era of the Web, but
 only if we do not limit the options to the user-centric/control
 paradigms of the past.

Hi Sullivan,

I certainly agree that browsers aren't the only web context or
use-case. However I strongly feel that we should design APIs for
browsers separately from APIs where the security model is different
from that of browsers.

For example in a browser it is unacceptable for the web page to read
the users file system without the user first granting access to this.
And even then there are likely restrictions as to prevent users from
getting hacked just because they clicked yes on a dialog they didn't
understand and just wanted to go away (aka the whatever dialog
problem).

On the flip side, it might make a lot of sense for a widget running on
a mobile phone, which some authority has authorized, to have read
access to large parts of the phones file system. And possibly even
write access to parts of it.

However these differences in security model will likely lead to
differences in API. This is ok. Lessons from the past, with for
example the DOM-Core spec, show that if we try to create an API that
fit too many different audiences (in that case it was both server-side
environments, as well as web pages). I would really like to avoid
repeating similar mistakes.

So my suggestion is that we let the FileWriter and File System APIs be
ones that are designed for the browser security model. And let them be
designed in the webapps WG which is already working on several very
similar features (for example I would argue that IndexedDB should
supersede File system).

If you or anyone else wants to design similar file related
specifications, but that has different security model or otherwise
different requirements than what exists in the web browser context,
then this in no way should impact you. If this should happen in DAP,
BONDI, or even in WebApps is a separate question which I basically
don't have much of an opinion on at all.

/ Jonas



RE: Transferring File* to WebApps - redux

2010-06-15 Thread SULLIVAN, BRYAN L (ATTCINW)
Arun,

I am not meaning to be unfair, perhaps the message is not coming through
clearly enough. 

There are specific technical requirements that we need these APIs to
fulfill, that I indicated to Thomas in another email:
1) access filesystems on the host device
2) traverse directories
3) read files as they exist on the filesystem (not just a local
representation in memory, as currently defined in the File API to my
understanding), in bytes and lines
4) write files (similar requirement to write directly to the
filesystem), in bytes and lines, with overwrite and append options
5) do the above programmatically in Javascript (not dependent just upon
user selection of an input element and interaction with a file selector)
6) provide security for this using the policy-framework approach as
being defined for DAP APIs

Apart from the details of (1-4) above, which will help ensure are
addressed in the current File* APIs (no matter where they are
finished),I think it's (5-6) where the real differences are. If we need
another API in DAP to address them, then ATT will help ensure it gets
done separately from the current File* APIs.

The question of where you are represented and your ability to
participate cuts both ways - the same is true for us. I think if the
browser vendors want their products really to be seen as compatible with
the Web application space (as compared to just dynamic Web pages), they
will support the work in DAP as its there that non-obtrusive and
inherently secure models for Web application access to device resources
will be defined as APIs.

Thanks, 
Bryan Sullivan | ATT


-Original Message-
From: Arun Ranganathan [mailto:a...@mozilla.com] 
Sent: Tuesday, June 15, 2010 2:53 PM
To: SULLIVAN, BRYAN L (ATTCINW)
Cc: Robin Berjon; public-device-a...@w3.org; Ian Fette; Web Applications
Working Group WG
Subject: Re: Transferring File* to WebApps - redux

On 6/15/10 2:24 PM, SULLIVAN, BRYAN L (ATTCINW) wrote:
 Arun,

 The basic concern I have is with the notion of browsers as the only
 Web context and use-case that matters. The browser-based model for API
 integration view (as I understand your position) is that the user must
 be actively involved in every significant action, and choose
explicitly
 the actions that enable integration with browser-external resources
 (including local and remote). Step back and you will see the
 inconsistency in that (what would Ajax be if the user had to approved
 every HTTP API request via aninput  element?).


In the case of the File API, I'm merely stating that the capability 
should be an evolution on top of what web pages already do with respect 
to the input element, and not introduce a new unbounded API space which 
doesn't consider user involvement, or reconsiders it with other consent 
models.  Equating ajax with this in general isn't relevant to the
argument.

If you have no substantial technical differences with FileReader, 
FileWriter, and the FileSystem API, why are you blocking them from 
moving?  What additional oversight does the DAP WG provide, that the 
WebApps WG does NOT provide?  The WebApps WG has MORE browser vendors 
than the DAP WG, allowing review that's pertinent to the technology we 
are building.  Below, you say:
 Webapps are much more than just dynamic Web pages. They are
 applications, and with HTML5 will have the ability to rival desktop
 applications, as is clearly the vision of many in the industry. It
might
 even enable a return to a thin client world (e.g. browser as OS) in
 which most significant resources are cloud-based. I see the logic and
 value in that, but it's not the only valid (and valuable) model.

 W3C focuses on the Web, and the Web is bigger than the browser
use-case.
 HTML5 and the APIs that attach HTML-based applications to the world
can
 actually be the application platform for the next era of the Web, but
 only if we do not limit the options to the user-centric/control
 paradigms of the past.


But, by charter, the DAP WG allows you to address those very use cases!

If the FileWriter, FileSystem, and FileReader specifications do NOT 
address the vision you articulate above, why not create a specification 
relevant to your use case?  Naturally, browser vendors see value in 
technology that serves the cause of dynamic web pages.  Why are you 
disallowing maximum browser vendor review by prohibiting a sensible 
move?  Even within the DAP WG, feedback isn't as forthcoming on these 
specifications as it is in the WebApps WG.

Please reconsider your stance here.  You are not providing technical 
feedback on the specifications in question, nor illustrating why they 
don't address your use cases.  But, you are blocking them from moving to

a place where there *is* healthy technical feedback, worrying that those

who *are* providing technical feedback will be poor custodians of a 
technology they are enthusiastic about building into their products.  
This is unfair.

-- A*



RE: Transferring File* to WebApps - redux

2010-06-15 Thread SULLIVAN, BRYAN L (ATTCINW)
Actually I think sandboxing an app into a certain area of the
filesystem, especially for less-trusted apps, is a useful model. But I
don't think the current File* APIs will support the items 5-6 that I
mention below.

5) do the above programmatically in Javascript (not dependent just upon
user selection of an input element and interaction with a file selector)

6) provide security for this using the policy-framework approach as
being defined for DAP APIs

 

In BONDI, it's possible to define the sandbox as policy and avoid the
user needing to select it. For example it's possible to restrict an
application to:

* a temp filesystem location (whatever that maps to on the
current device)

* other well-known filesystem locations

* browser-internal storage (e.g. localstorage)

 

Thanks, 

Bryan Sullivan | ATT

 

From: Mike Clement [mailto:mi...@google.com] 
Sent: Tuesday, June 15, 2010 3:42 PM
To: SULLIVAN, BRYAN L (ATTCINW)
Cc: a...@mozilla.com; Robin Berjon; public-device-a...@w3.org; Ian
Fette; Web Applications Working Group WG
Subject: Re: Transferring File* to WebApps - redux

 

Hi,

 

Am I correct in thinking that what you find too restrictive is that the
FileSystem API only allows programmatic access to a sandboxed portion of
the device's filesystem instead of the entire filesystem?  Otherwise, I
believe that the File APIs as a whole will allow most of the other
operations you mention.

 

--mike

On Tue, Jun 15, 2010 at 3:24 PM, SULLIVAN, BRYAN L (ATTCINW)
bs3...@att.com wrote:

Arun,

I am not meaning to be unfair, perhaps the message is not coming through
clearly enough.

There are specific technical requirements that we need these APIs to
fulfill, that I indicated to Thomas in another email:
1) access filesystems on the host device
2) traverse directories
3) read files as they exist on the filesystem (not just a local

representation in memory, as currently defined in the File API to my
understanding), in bytes and lines

4) write files (similar requirement to write directly to the

filesystem), in bytes and lines, with overwrite and append options

5) do the above programmatically in Javascript (not dependent just upon

user selection of an input element and interaction with a file selector)

6) provide security for this using the policy-framework approach as

being defined for DAP APIs

Apart from the details of (1-4) above, which will help ensure are
addressed in the current File* APIs (no matter where they are
finished),I think it's (5-6) where the real differences are. If we need
another API in DAP to address them, then ATT will help ensure it gets
done separately from the current File* APIs.

The question of where you are represented and your ability to
participate cuts both ways - the same is true for us. I think if the
browser vendors want their products really to be seen as compatible with
the Web application space (as compared to just dynamic Web pages), they
will support the work in DAP as its there that non-obtrusive and
inherently secure models for Web application access to device resources
will be defined as APIs.


Thanks,
Bryan Sullivan | ATT


-Original Message-
From: Arun Ranganathan [mailto:a...@mozilla.com]

Sent: Tuesday, June 15, 2010 2:53 PM
To: SULLIVAN, BRYAN L (ATTCINW)
Cc: Robin Berjon; public-device-a...@w3.org; Ian Fette; Web Applications
Working Group WG
Subject: Re: Transferring File* to WebApps - redux

On 6/15/10 2:24 PM, SULLIVAN, BRYAN L (ATTCINW) wrote:
 Arun,

 The basic concern I have is with the notion of browsers as the only
 Web context and use-case that matters. The browser-based model for API
 integration view (as I understand your position) is that the user must
 be actively involved in every significant action, and choose
explicitly
 the actions that enable integration with browser-external resources
 (including local and remote). Step back and you will see the
 inconsistency in that (what would Ajax be if the user had to approved
 every HTTP API request via aninput  element?).


In the case of the File API, I'm merely stating that the capability
should be an evolution on top of what web pages already do with respect
to the input element, and not introduce a new unbounded API space which
doesn't consider user involvement, or reconsiders it with other consent
models.  Equating ajax with this in general isn't relevant to the
argument.

If you have no substantial technical differences with FileReader,
FileWriter, and the FileSystem API, why are you blocking them from
moving?  What additional oversight does the DAP WG provide, that the
WebApps WG does NOT provide?  The WebApps WG has MORE browser vendors
than the DAP WG, allowing review that's pertinent to the technology we
are building.  Below, you say:
 Webapps are much more than just dynamic Web pages. They are
 applications, and with HTML5 will have the ability to rival desktop
 applications, as is clearly the vision of many in the industry. It
might
 even enable

RE: Transferring File* to WebApps - redux

2010-06-15 Thread SULLIVAN, BRYAN L (ATTCINW)
Mike,

 

To be clear - I'm not saying that the current File* APIs are poorly
designed or that they won't be useful. As I have read through them I
agree there is a lot of the functionality that we are looking for in
them and we appreciate the effort it took to create them, even though
they are different from the BONDI API (there are many good ways to
design such things). Extending them will be one option if we can't
resolve the gaps in the APIs directly.

 

But if we can count on a couple of key things then in the interest of
having a single API for developers to use, I would agree we should focus
on these APIs and see how far they can take us:

 

1)  An app can use resolveLocalFilesystemURI directly to resolve a
generic filesystem URI, e.g. documents, pictures, videos, music
(we can create a normative set of these), or some other URI that is
known to be supported by the device (which is itself known for example
through the System Info API), e.g. file://home/user
file:///\\home\user . Alternatively we can extend the LocalFilesystem
interface with a getRootLocations method ala the BONDI filesystem API.

2)  Access to resolveLocalFilesystemURI can be defined in policy (the
resolve method can have an assigned feature URI used in widget config
and policy documents), thus the user does not have to be prompted (if
the app is trusted) or the input element used.

 

Note that the alternatives requestPersistentFilesystem and
requestTemporaryFilesystem are quite useful also, and may support the
majority of use cases anyway.

 

Thanks, 

Bryan Sullivan | ATT

 

From: Mike Clement [mailto:mi...@google.com] 
Sent: Tuesday, June 15, 2010 4:40 PM
To: SULLIVAN, BRYAN L (ATTCINW)
Cc: a...@mozilla.com; Robin Berjon; public-device-a...@w3.org; Ian
Fette; Web Applications Working Group WG
Subject: Re: Transferring File* to WebApps - redux

 

As I understand it, #5 (programmatic access to files without user
interaction) is indeed supported via the getFile method.  But again,
this is only within the sandboxed filesystem, not for an arbitrary file
on the device.

 

As for #6, I can't speak to the policy-framework approach, but I do
know that the security provisions for manipulating files with regards to
JavaScript will be the usual same-origin policy.

 

--mike

 

 

On Tue, Jun 15, 2010 at 3:55 PM, SULLIVAN, BRYAN L (ATTCINW)
bs3...@att.com wrote:

Actually I think sandboxing an app into a certain area of the
filesystem, especially for less-trusted apps, is a useful model. But I
don't think the current File* APIs will support the items 5-6 that I
mention below.

5) do the above programmatically in Javascript (not dependent just upon
user selection of an input element and interaction with a file selector)

6) provide security for this using the policy-framework approach as
being defined for DAP APIs

 

In BONDI, it's possible to define the sandbox as policy and avoid the
user needing to select it. For example it's possible to restrict an
application to:

* a temp filesystem location (whatever that maps to on the
current device)

* other well-known filesystem locations

* browser-internal storage (e.g. localstorage)

 

Thanks, 

Bryan Sullivan | ATT

 

From: Mike Clement [mailto:mi...@google.com] 
Sent: Tuesday, June 15, 2010 3:42 PM


To: SULLIVAN, BRYAN L (ATTCINW)

Cc: a...@mozilla.com; Robin Berjon; public-device-a...@w3.org; Ian
Fette; Web Applications Working Group WG


Subject: Re: Transferring File* to WebApps - redux

 

Hi,

 

Am I correct in thinking that what you find too restrictive is that the
FileSystem API only allows programmatic access to a sandboxed portion of
the device's filesystem instead of the entire filesystem?  Otherwise, I
believe that the File APIs as a whole will allow most of the other
operations you mention.

 

--mike

On Tue, Jun 15, 2010 at 3:24 PM, SULLIVAN, BRYAN L (ATTCINW)
bs3...@att.com wrote:

Arun,

I am not meaning to be unfair, perhaps the message is not coming through
clearly enough.

There are specific technical requirements that we need these APIs to
fulfill, that I indicated to Thomas in another email:
1) access filesystems on the host device
2) traverse directories
3) read files as they exist on the filesystem (not just a local

representation in memory, as currently defined in the File API to my
understanding), in bytes and lines

4) write files (similar requirement to write directly to the

filesystem), in bytes and lines, with overwrite and append options

5) do the above programmatically in Javascript (not dependent just upon

user selection of an input element and interaction with a file selector)

6) provide security for this using the policy-framework approach as

being defined for DAP APIs

Apart from the details of (1-4) above, which will help ensure are
addressed in the current File* APIs (no matter where they are
finished),I think it's (5-6) where the real differences are. If we need
another API in DAP to address them, then ATT

Regrets for today

2010-06-10 Thread SULLIVAN, BRYAN L (ATTCINW)
I will not be able to attend today's call.

Bryan | ATT

 



RE: Event handlers - Pointer Devices

2010-03-04 Thread SULLIVAN, BRYAN L (ATTCINW)
OK, I agree, let's see a draft horse first, then later we can decide if it was 
worth dressing it up for the cart.

On the main (or more useful) point perhaps, I think the distinction between a 
device's internal features, its peripherals as attached features, and more 
abstracted (even remote) resources is still very blurry between Webapps and 
DAP. For example, DAP is considering whether to represent device API's (called 
device here only because in some instances the resource provider might be 
local to the device) using an abstracted RESTful model (Powerbox) that I have 
asserted fits better in the Web API work in Webapps, because it's more aligned 
with the RESTful model of remote resource access over HTTP. And here we have 
consideration of screen input and mouse events, which are resources of the host 
device, at least when attached to it.

I'd like to see some clearer distinction between the charters on these points. 

Thanks, 
Bryan Sullivan | ATT

-Original Message-
From: Doug Schepers [mailto:schep...@w3.org] 
Sent: Thursday, March 04, 2010 7:08 AM
To: SULLIVAN, BRYAN L (ATTCINW)
Cc: Charles Pritchard; public-webapps@w3.org
Subject: Re: Event handlers - Pointer Devices

Hi, Bryan-

SULLIVAN, BRYAN L (ATTCINW) wrote (on 3/4/10 9:15 AM):
 This might be better discussed by the DAP group, as it's clearly a
 device API topic.

By that definition, a mouse would be a device. :)  This work belongs in 
the WebApps WG, and it is explicitly mentioned in our charter, to be 
taken up during our next charter period.

DAP is not focused on user-input devices, more on things like cameras, 
calendars, etc. available on the local device.


 Also it would be interesting to hear from Apple and Wacom (without
 unnecessary details at this point), what areas of touch interface
 capabilities would be problematic for W3C to create API's for, from an
 IPR perspective (i.e. that would probably result in exclusions)... this
 concern is driven e.g. by the current touch-related issue between Apple
 and HTC.

This is putting the cart before the horse.  It's not appropriate to 
discuss IPR at this point, since we don't even have a draft spec (by 
design).  Once we have a draft of the spec, participants who have IPR 
can have their legal team look at it and chime in at that point (though 
this may take place in Member space, since they may wish to do so under 
the legal framework of W3C Member confidentiality).

I am concerned that it may not be fruitful, and may be 
counterproductive, for us to start speculating on this list about IPR. 
Let's keep the discussion on technical matters, please.

However, use cases and requirements would be appropriate to discuss, and 
this should help frame a successful outcome for this spec.

[1] http://www.w3.org/2009/05/DeviceAPICharter

Regards-
-Doug Schepers
W3C Team Contact, SVG and WebApps WGs


RE: DAP and security (was: Rename File API to FileReader API?)

2009-11-18 Thread SULLIVAN, BRYAN L (ATTCINW)
Maciej, 

Security is important in DAP, and should be considered carefully in the context 
of each API and its use cases. There is no one size fits all solution to 
security, and that includes approaches based solely upon explicit user action 
(including explicitly expressed permission via dialogs). 

The ability to define trust and related policy in a manageable policy document 
is a necessary *supplement* to the native (API-specific) security methods 
inherent in API's and their support/influence on the UI. The supplement ensures 
that the security approach can be tailored to the device in which the webapp is 
running, supporting a better user experience where reliance upon implicit user 
action is insufficient.

It is however just a supplement that may applied in specific cases, and its use 
is a deployment decision. BONDI defined such a policy file based upon XACML 
concepts (this has been provided as input to DAP), and ATT (among others 
supporting BONDI) considers this to be a valuable option, which complements the 
API-specific methods.

Best regards,
Bryan Sullivan | ATT
-Original Message-
From: public-device-apis-requ...@w3.org 
[mailto:public-device-apis-requ...@w3.org] On Behalf Of Maciej Stachowiak
Sent: Wednesday, November 18, 2009 4:35 AM
To: Marcin Hanclik
Cc: Dominique Hazael-Massieux; Robin Berjon; public-device-a...@w3.org; 
public-webapps WG
Subject: Re: DAP and security (was: Rename File API to FileReader API?)


OK, I will take your word for it that security is an important  
consideration for DAP. But while at the TPAC, I heard more than one  
DAP participant say, when faced with a potential security concern,  
something like can't we just leave that up to the policy? In one  
case when I enquired further, at least one DAP member mentioned to me  
the idea of using some sort of policy file that would take care of  
all security issues. He suggested this might come from a corporate  
administrator, and that the format would be XML, but otherwise details  
were light.

To me that seems like a plausible model for something like widgets or  
browser extensions or walled garden content, but not for sites on the  
public Web.

My apologies if I misinterpreted these remarks or got the wrong  
impression.

One more comment below:

On Nov 18, 2009, at 4:18 AM, Marcin Hanclik wrote:

 +1
 APIs - specifically their design - shall be specified tightly with  
 the security model in mind to make them both easy to use and  
 effective.
 This is what makes the whole task that difficult.

 Thanks,
 Marcin

 Marcin Hanclik
 ACCESS Systems Germany GmbH
 Tel: +49-208-8290-6452  |  Fax: +49-208-8290-6465
 Mobile: +49-163-8290-646
 E-Mail: marcin.hanc...@access-company.com

 -Original Message-
 From: public-device-apis-requ...@w3.org 
 [mailto:public-device-apis-requ...@w3.org 
 ] On Behalf Of Dominique Hazael-Massieux
 Sent: Thursday, November 12, 2009 10:30 AM
 To: Maciej Stachowiak
 Cc: Robin Berjon; public-device-a...@w3.org; public-webapps WG
 Subject: DAP and security (was: Rename File API to FileReader  
 API?)

 Le mardi 10 novembre 2009 à 17:47 -0800, Maciej Stachowiak a écrit :
 I would be concerned with leaving file writing to DAP, because a
 widely held view in DAP seems to be that security can be ignored  
 while
 designing APIs and added back later with an external policy file
 mechanism.

 Frederick already mentioned this isn't the case at all, and I want to
 strongly reject the notion that DAP is considering security as an
 after-the-fact or out-of-band aspect in the design of its APIs.

 Our charter clearly stipulates that our policy model must be  
 consistent
 with the existing same origin policies (as documented in the HTML5
 specification), in the sense that a deployment of the policy model in
 Web browsers must be possible.

It seems to me that for most of DAP's likely deliverables, there are  
serious security considerations, but the same-origin policy is  
irrelevant to addressing them. The same-origin policy is designed to  
protect Web sites from attacks by other Web sites. It does not really  
apply to access to system resources. Doing that in a Web-safe way will  
require new inventions or might not even be possible in some cases.


 In fact, most of models that have been discussed in this thread to
 reduce the risks exposed by new APIs (sandbox for writing, user
 interaction or markup-based element for sharing data) were already
 mentioned as options by DAP WG participants during our F2F last week.

 More generally, I don't think assuming that DAP would create worse/ 
 less
 secure APIs than WebApps or any other group would is either right nor
 useful to ensure a good collaboration between our groups. And clearly,
 we will actively be seeking feedback and input from the WebApps  
 Working
 Group when we produce new APIs, which should also contribute to reduce
 the fears that we would get it all wrong :)

 Regards,

 Dom




 

RE: [WARP] Comments to WARP spec

2009-11-12 Thread SULLIVAN, BRYAN L (ATTCINW)
Hi Marcos,
Opera 9.5 running on Windows Mobile 6.1 and Opera 10 running on PC both allow 
access to scripts and images from different domains than a widget was obtained 
from. I have tested this and can provide a working example (see below for the 
index.html - package it yourself and see).

Thus the same-origin restriction does not apply in current Opera 
implementations for externally referenced scripts and images. The processing of 
the access element as defined in WARP is not consistent with the current 
Opera implementation.

So what do you mean by We've had a similar model in place for a long time in 
our proprietary implementation?

!DOCTYPE html
html
head
meta charset=utf-8 /
link rel=stylesheet type=text/css href=style.css /
script src=http://www.json.org/json2.js;/script
script
function bodyLoad() {
var str = boohoo!;
try { str = JSON.stringify(['e', {pluribus: 'unum'}]); 
str = hooray!;}
catch (e) { } 
document.getElementById(test1).innerHTML = str;
}
/script
/head
body onload=javascript:bodyLoad();
pNot Same-Origin Resource Access Test: a test of the same-origin rule 
for resources 
accessed from domains other than where the widget was obtained./p
hr/
pTest 1: If the widget engine does not allow external script 
references, no you will 
see boohoo! below:/p
div id=test1/div
hr/
pTest 2: If the widget engine does not allow external image 
references, no image will 
be shown below:/p
img src=http://dev.opera.com/img/logo-beta.gif/
/body
/html

Best regards,
Bryan Sullivan | ATT

-Original Message-
From: Marcos Caceres [mailto:marc...@opera.com] 
Sent: Tuesday, November 10, 2009 1:02 PM
To: SULLIVAN, BRYAN L (ATTCINW)
Cc: WebApps WG
Subject: Re: [WARP] Comments to WARP spec



SULLIVAN, BRYAN L (ATTCINW) wrote:
 Placing broad restrictions on widget-context webapp access to network 
 resources (substantially different from browser-context webapps) is not an 
 effective approach to creating a useful widget-context webapp platform. That 
 would create a significant barrier to market acceptance of the W3C widget 
 standards.

Opera does not agree. We've had a similar model in place for a long time 
in our proprietary implementation and we have not faced any issues in 
the marketplace.

The WARP spec solves many problems that arise from not actually having a 
network established origin, and may even avoid the confused deputy 
problem CORS is currently facing (which locally running widgets won't be 
able to use anyway).

I think that technically we are in agreement; but we are just in 
disagreement about the level of granularity that the WARP spec affords 
to authors. For the record, I like the way WARP is currently specified: 
it's easy to use, and essentially works in much the same way as the same 
origin policy does for Web documents... but with the added bonus of 
being able to do cross origin - but with the restriction of not being 
unrestricted, like it's the case for web documents.


RE: [WARP] Comments to WARP spec

2009-11-10 Thread SULLIVAN, BRYAN L (ATTCINW)
Marcos,
I agree there is an assumption behind the approach I proposed, which I also 
believe will be valid for the vast majority of widgets which will actually have 
index.html or something like that as the start page. Further, the statements 
in the config.xml apply to all resources in the widget, not just the start 
page, i.e. I can start with a non-HTML which references an HTML file in the 
package, to which the tag attribute applies.

If the proposed solution is inadequate, I welcome other suggestions. But as it 
stands, the WARP spec is not consistent with the web security model, so we need 
to fix the access element definition somehow.

Best regards,
Bryan Sullivan | ATT
-Original Message-
From: Marcos Caceres [mailto:marc...@opera.com] 
Sent: Tuesday, November 10, 2009 1:36 AM
To: SULLIVAN, BRYAN L (ATTCINW)
Cc: WebApps WG
Subject: Re: [WARP] Comments to WARP spec



SULLIVAN, BRYAN L (ATTCINW) wrote:
 Marcos,

 Re I'm personally not in favor of trying to deviate too much from the Web 
 security model.: I agree with you, and that is the point of the comments. 
 The web security model (I think you mean the same-origin restriction) does 
 not restrict access to image content from anywhere, like theaccess  element 
 would. Theaccess  element as currently in the WARP spec goes beyond the 
 web security model.

 My point is that the statement below in the WARP spec needs to change, 
 because this is not compatible with the web security model, and also makes 
 more work for implementers because the security model for widget-context 
 webapps would not be the same as for browser-context webapps: In the default 
 policy, a user agent must deny access to network resources  external to the 
 widget by default, whether this access is requested through APIs (e.g. 
 XMLHttpRequest) or through markup (e.g. iframe, script, img).

 So either:
 (1) we need to be specific about which API's / resource types are affected by 
 inclusion (or exclusion) of domains inaccess  (and keep this equivalent to 
 HTML5)
 (2) we must add a way for the developer to indicate which types of references 
 should be allowed for the domain

 My preference would be (1), but I proposed the use of tag= to illustrate 
 how (2) might work.


Again, @tag= assumes HTML. There could be many different variant start 
files in a widget. Consider the case where you have a compound XML 
document as the start file (HTML + SVG + Custom XML)... how would you 
say which element this applies to and in which namespace? Also tag 
makes no sense in the context of CSS, XHR, etc.


RE: [WARP] Comments to WARP spec

2009-11-10 Thread SULLIVAN, BRYAN L (ATTCINW)
Marcos,
Re the whole point of WARP is to put these boundaries around the behavior of 
widgets because they run locally., there is really no difference between 
browser-context and widget-context webapps in that sense. Both run on the 
device, and both can access device resources and network resources. The only 
essential difference is that widgets are downloaded and installed as a package 
which can define some extra information that is useful in the install phase of 
the application lifecycle (e.g. compatibility checks via the the feature and 
access elements).

I don’t believe it is correct to say that How a browsing context should behave 
when run locally is not really defined by HTML5.. I believe that regardless of 
where a web page originates, the security model must be consistent. For the 
part of HTML5 (e.g. access to DOM elements) that depends upon same-origin 
restrictions, the source of the stored content is important (and should anyway 
be known by the browser in most cases), but for the other parts (e.g. img tag 
and referenced scripts) it is irrelevant. 

Placing broad restrictions on widget-context webapp access to network resources 
(substantially different from browser-context webapps) is not an effective 
approach to creating a useful widget-context webapp platform. That would create 
a significant barrier to market acceptance of the W3C widget standards.

Best regards,
Bryan Sullivan | ATT
-Original Message-
From: Marcos Caceres [mailto:marc...@opera.com] 
Sent: Tuesday, November 10, 2009 7:30 AM
To: SULLIVAN, BRYAN L (ATTCINW)
Cc: WebApps WG
Subject: Re: [WARP] Comments to WARP spec



SULLIVAN, BRYAN L (ATTCINW) wrote:
 Marcos,
 I agree there is an assumption behind the approach I proposed, which I also 
 believe will be valid for the vast majority of widgets which will actually 
 have index.html or something like that as the start page. Further, the 
 statements in the config.xml apply to all resources in the widget, not just 
 the start page, i.e. I can start with a non-HTML which references an HTML 
 file in the package, to which the tag attribute applies.

So we are clear, the tag attribute does not work in the following 
situation. I want to disable x:script, but allow v:script... unless you 
know what the things different namespaces will not be added dynamically 
to the DOM:

x:html xmlns:x=http://www.w3.org/1999/xhtml;
...
x:script ... /x:script

v:svg v:width=6cm v:height=5cm v:viewBox=0 0 600 500
  xmlns:v=http://www.w3.org/2000/svg; version=1.1
   v:script src=../v:script
/v:svg

/x:html

 If the proposed solution is inadequate, I welcome other suggestions.

I don't have a suggestion because I don't believe this part of WARP is 
broken or is necessary.

 But as it stands, the WARP spec is not consistent with the web 
security model, so we need to fix theaccess  element definition somehow.

  Well, the whole point of WARP is to put these boundaries around the 
behavior of widgets because they run locally. How a browsing context 
should behave when run locally is not really defined by HTML5. This 
leaves a gap for us to fill.


RE: [WARP] Comments to WARP spec

2009-11-09 Thread SULLIVAN, BRYAN L (ATTCINW)
Marcos,

Re I'm personally not in favor of trying to deviate too much from the Web 
security model.: I agree with you, and that is the point of the comments. The 
web security model (I think you mean the same-origin restriction) does not 
restrict access to image content from anywhere, like the access element 
would. The access element as currently in the WARP spec goes beyond the web 
security model. 

My point is that the statement below in the WARP spec needs to change, because 
this is not compatible with the web security model, and also makes more work 
for implementers because the security model for widget-context webapps would 
not be the same as for browser-context webapps: In the default policy, a user 
agent must deny access to network resources  external to the widget by default, 
whether this access is requested through APIs (e.g. XMLHttpRequest) or through 
markup (e.g. iframe, script, img).

So either:
(1) we need to be specific about which API's / resource types are affected by 
inclusion (or exclusion) of domains in access (and keep this equivalent to 
HTML5)
(2) we must add a way for the developer to indicate which types of references 
should be allowed for the domain

My preference would be (1), but I proposed the use of tag= to illustrate how 
(2) might work.

Best regards,
Bryan Sullivan | ATT
-Original Message-
From: Marcos Caceres [mailto:marc...@opera.com] 
Sent: Monday, November 09, 2009 2:01 AM
To: SULLIVAN, BRYAN L (ATTCINW)
Cc: WebApps WG
Subject: Re: [WARP] Comments to WARP spec



SULLIVAN, BRYAN L (ATTCINW) wrote:
 Hi Marcos,

 To be clear, your answer addresses point (2) only, and while I realize that 
 the idea proposed may not apply to all valid start files, it nonetheless did 
 address the point of the comment. It may not be the best solution but it is 
 just a start on one, I hope.

 I still think we should recognize and somehow address the significant 
 limitations of blanket handling of all external references ala In the 
 default policy, a user agent must deny access to network resources  external 
 to the widget by default, whether this access is requested through APIs (e.g. 
 XMLHttpRequest) or through markup (e.g. iframe, script, img).

 I think this will have a significant impact on the functionality of web 
 applications that should be able to access wide sources of media content, but 
 want to be more selective on sources of scripts.

Although I understand the rationale, I'm personally not in favor of 
trying to deviate too much from the Web security model. This proposal 
seems to make more work for authors rather than providing security 
enhancements. It also makes more work for implementers in that they need 
to change the security model of the browsers on which widget engines run.

Kind regards,
Marcos


[WARP] Comments to WARP spec

2009-11-02 Thread SULLIVAN, BRYAN L (ATTCINW)
Here are the comments I had to the WARP spec in the Webapps/DAP joint
meeting:

1) Does * grant/require either HTTP or HTTPS as schemes? It would be
better to allow https://*/; or http://*/; distinctly since some
applications may not be allowed by policy to access specific sources
using non-secure HTTP, e.g. an e-commerce-enabled application. It would
thus not be possible to include both http://*/; (for generic content)
and also limit access to the e-commerce sensitive sites via HTTPS.
 
2) Re A user agent enforces an access request policy. In the default
policy, a user agent must deny access to network resources  external to
the widget by default, whether this access is requested through APIs
(e.g. XMLHttpRequest) or through markup (e.g. iframe, script, img)..
Note that content that is typically not executable, e.g. img sources,
this limitation on access to linked resources is significant, and will
require e.g. for mashup applications that all content and references are
pre-retrieved (or reference URI's re-written at least, to be proxied
upon request) by the web application server (or set of servers as
represented by the access list). It would be good to consider a way for
the webapp to allow for certain types of content reference methods to be
allowed from a wider set of sources, while preserving restrictions on
others, e.g.:

access origin=http://trustedsite.com; tag=script/
access origin=* tag=img/

Best regards,
Bryan Sullivan | ATT





RE: TPAC agenda - APIs

2009-10-27 Thread SULLIVAN, BRYAN L (ATTCINW)
Hi Charles,
I have an agenda item for the AOB section or wherever it can fit. I will be 
spending most of the time with DAP and part with Webapps (Widgets), but will 
try to balance the agendas to be in the APIs meeting as much as possible.

The basic question I have is what is the relationship of the following specs to 
the HTML5 package (being normatively referenced by HTML5). Is it expected 
that they will reach LCWD stage along with HTML5?
- Cross-Origin Resource Sharing (CORS)
- Server-Sent Events
- Web Sockets
- Web Workers

These are not normatively referenced by HTML5:
- Web Database
- WebSimpleDB API

There does not seem to be a lot of discussion on some of these specs, although 
there are periodic updates. Is there expected to be a period of more active 
group discussion prior to LCWD for those that have been moving along more 
quietly?

I have some specific questions on the specs, that I will send in separate 
emails. It would be helpful to be able to discuss some of these points in a F2F 
setting, at least any significant ones that can't be resolved by email in 
advance.

Best regards,
Bryan Sullivan | ATT

-Original Message-
From: public-webapps-requ...@w3.org [mailto:public-webapps-requ...@w3.org] On 
Behalf Of Charles McCathieNevile
Sent: Tuesday, October 27, 2009 4:09 AM
To: WebApps WG
Subject: TPAC agenda - APIs

Hi folks,

there is a proposed timeline at  
http://www.w3.org/2008/webapps/wiki/TPAC2009APIs#Agenda_Items

Please have a look, and if you think your input is important for any  
session but you will be in a different session, or only participating  
remotely, please let us know ASAP so we can attempt to make necessary  
arrangements (dial-up might be hard, but we can move the sessions that are  
not joint sessions).

Note that some sessions have fairly small things in them. It would be nice  
to have some more free time, although we will probably manage to soak it  
up with discussion of other issues.

cheers

Chaals

-- 
Charles McCathieNevile  Opera Software, Standards Group
 je parle français -- hablo español -- jeg lærer norsk
http://my.opera.com/chaals   Try Opera: http://www.opera.com



RE: [widgets] Draft Agenda for 17 September 2009 voice conf

2009-09-17 Thread SULLIVAN, BRYAN L (ATTCINW)
Regrets, I have a conflicting meeting.

Best regards,
Bryan Sullivan | ATT




Close ACTION-357

2009-08-13 Thread SULLIVAN, BRYAN L (ATTCINW)
Hi Art,
My action http://www.w3.org/2008/webapps/track/actions/357 can be closed. The 
table that was requested was provided in Widgets 1.0: Window Modes and Media 
Query Extensions http://dev.w3.org/2006/waf/widgets-wm/Overview.src.html. I 
didn't do it, but it does meet the original request related to the action:

BS: The height and width attribute in PC have a reference to the
widget views spec

AB: We need to make sure Widgets VIews talks about which modes would
support this
... Some of us feel that User Agents should have flexibility wrt
what modes might support this stuff

BS: This should be easy, right?
... Which attributes are dependent on view modes, and which are
independent. and could we have a table?

AB: That sounds great for someone to write

scribe ACTION: Bryan to make a table (if it's easy) [recorded in
[26]http://www.w3.org/2009/06/10-wam-minutes.html#action03]

trackbot Created ACTION-357 - Make a table (if it's easy) [on
Bryan Sullivan - due 2009-06-17].

Best regards,
Bryan Sullivan | ATT



Questions on AE spec

2009-06-09 Thread SULLIVAN, BRYAN L (ATTCINW)
Title: Questions on AE spec






Here are a couple of potentially easy questions on the Widgets 1.0: APIs and Events spec:



5.15 The openURL() Method

Does the appropriate protocol handler mean an external application (e.g. browser for http://) is invoked, or can the handler be the widget user agent itself (e.g. the method is similar to XHR, i.e. returns results as data objects)? It would be good to clarify what this means and give examples.

5.17 The showNotification() Method

Re The showNotification() method accepts three arguments: ... The second argument is a DOMString containing an informative message to be displayed to the end-user.

Is this a simple text string, or can it include any markup/style?



Best regards,

Bryan Sullivan |ATT