Re: Copyright license for ElementTraversal Java interface

2009-01-12 Thread Paul Libbrecht
I would like to add the wish to add this file as a jar within a W3C maven repository, maven is a build system based on declarative dependencies marking. The objective of a W3C maven repository would be to offer, in a way transparent to people that just checkout souces, a linking to W3C

Re: Copyright license for ElementTraversal Java interface

2009-01-12 Thread Michael Glavassevich
Paul Libbrecht p...@activemath.org wrote on 01/12/2009 07:24:52 AM: I would like to add the wish to add this file as a jar within a W3C maven repository, maven is a build system based on declarative dependencies marking. The objective of a W3C maven repository would be to offer, in a way

RE: Comments on Widgets 1.0 Security requirements

2009-01-12 Thread Priestley, Mark, VF-Group
Hi Frederick, All, As promised on last week's call some further clarifications below on R44. Thanks, Mark (1) R44 http://dev.w3.org/2006/waf/widgets-reqs/#r44.- This requirement is unclear. Is the intent to say that a signature associated with a widget package might be extracted and

Do we need to rename the Origin header?

2009-01-12 Thread Jonas Sicking
Hi all, There has been a lot of discussions lately in various forums about using an Origin header as a cross site request forgery (CSRF) protection mechanism. The idea has been to let the Origin header indicate who is causing the request, and can be used for sites to more easily see if the

Re: Do we need to rename the Origin header?

2009-01-12 Thread Thomas Roessler
On 12 Jan 2009, at 16:31, Jonas Sicking wrote: There are 3 possible solutions that I can see to this: 1. Change the name of the Origin header in Access-Control 2. Change the name of the Origin header used for CSRF protection 3. Change the behavior of one (or both) of the specs such that they

Re: Do we need to rename the Origin header?

2009-01-12 Thread Jonas Sicking
Thomas Roessler wrote: On 12 Jan 2009, at 16:31, Jonas Sicking wrote: There are 3 possible solutions that I can see to this: 1. Change the name of the Origin header in Access-Control 2. Change the name of the Origin header used for CSRF protection 3. Change the behavior of one (or both) of

Re: Do we need to rename the Origin header?

2009-01-12 Thread Ian Hickson
On Mon, 12 Jan 2009, Jonas Sicking wrote: Should I remove or rename 'Origin' in HTML5 for now? Well, HTML5 isn't the only place where this header has been discussed, but it wouldn't be a bad idea I think. Which, remove or rename? :-) -- Ian Hickson U+1047E