Re: [fileapi] urn - URL

2009-11-12 Thread Anne van Kesteren
On Thu, 12 Nov 2009 07:45:30 +0100, Julian Reschke julian.resc...@gmx.de wrote: Anne van Kesteren wrote: I don't see a reason why we should call the member urn. URL is much more consistent with other parts of the Web platform and works just as well. I thought we agreed on this previously so

Re: CSRF vulnerability in Tyler's GuestXHR protocol?

2009-11-12 Thread Devdatta
Hi Tyler, Some parts of the protocol are not clear to me. Can you please clarify the following : 1 In msg 1, what script context is the browser running in ? Site A or Site B ? (in other words who initiates the whole protocol ?) 2 Msg 3 is a form POST or a XHR POST ? If the latter , 5 needs to be

Re: STS and lockCA

2009-11-12 Thread Adam Barth
On Wed, Nov 11, 2009 at 7:25 AM, Bil Corry b...@corry.biz wrote: Would LockCA prevent the site from loading if it encountered a new cert from the same CA? My understanding is that it would not.  Or are you talking about a site that wants to switch CAs and is using LockCA? I think Gervase

DAP and security (was: Rename “File API” to “FileReader API”?)

2009-11-12 Thread Dominique Hazael-Massieux
Le mardi 10 novembre 2009 à 17:47 -0800, Maciej Stachowiak a écrit : I would be concerned with leaving file writing to DAP, because a widely held view in DAP seems to be that security can be ignored while designing APIs and added back later with an external policy file mechanism.

Re: Use Cases and Requirements for Saving Files Securely

2009-11-12 Thread Jonas Sicking
On Wed, Nov 11, 2009 at 6:59 PM, Maciej Stachowiak m...@apple.com wrote: On Nov 11, 2009, at 3:51 PM, Eric Uhrhane wrote: On Mon, Nov 9, 2009 at 4:21 PM, Maciej Stachowiak m...@apple.com wrote: On Nov 9, 2009, at 12:08 PM, Ian Hickson wrote: On Mon, 2 Nov 2009, Doug Schepers wrote:

Re: Use Cases and Requirements for Saving Files Securely

2009-11-12 Thread イアンフェッティ
This is really getting into fantasy-land... Writing a file and hoping that the user actually opens up explorer/finder/whatever and browses to some folder deep within the profile directory, and then double clicks something? Telling a user click here and run blah to get a pony is so much easier.

Re: Use Cases and Requirements for Saving Files Securely

2009-11-12 Thread Jonas Sicking
2009/11/12 Ian Fette (イアンフェッティ) ife...@google.com: This is really getting into fantasy-land... Writing a file and hoping that the user actually opens up explorer/finder/whatever and browses to some folder deep within the profile directory, and then double clicks something? Telling a user click

Re: Use Cases and Requirements for Saving Files Securely

2009-11-12 Thread Adam Barth
2009/11/12 Jonas Sicking jo...@sicking.cc: 2009/11/12 Ian Fette (イアンフェッティ) ife...@google.com: This is really getting into fantasy-land... Writing a file and hoping that the user actually opens up explorer/finder/whatever and browses to some folder deep within the profile directory, and then

Re: STS and lockCA

2009-11-12 Thread Gervase Markham
On 11/11/09 15:25, Bil Corry wrote: Would LockCA prevent the site from loading if it encountered a new cert from the same CA? No. Hence the name - lock _CA_. :-P (BTW, I'm not subscribed to public-webapps; you'll need to CC me on any conversation you want me in.) Or are you talking about a

Re: Use Cases and Requirements for Saving Files Securely

2009-11-12 Thread イアンフェッティ
2009/11/12 Jonas Sicking jo...@sicking.cc 2009/11/12 Ian Fette (イアンフェッティ) ife...@google.com: This is really getting into fantasy-land... Writing a file and hoping that the user actually opens up explorer/finder/whatever and browses to some folder deep within the profile directory, and

Re: Use Cases and Requirements for Saving Files Securely

2009-11-12 Thread Jonas Sicking
2009/11/12 Ian Fette (イアンフェッティ) ife...@google.com: 2009/11/12 Jonas Sicking jo...@sicking.cc 2009/11/12 Ian Fette (イアンフェッティ) ife...@google.com: This is really getting into fantasy-land... Writing a file and hoping that the user actually opens up explorer/finder/whatever and browses to

Summary of Media Annotations WG 5th F2F in Santa Clara

2009-11-12 Thread Joakim Söderberg
Hello everyone, I hope you all had a fruitful meeting during the TPAC! Here is a short summary for Media Annotations WG (MAWG) 5th F2F meeting. The charter of the group is to facilitate for web developers to access metadata in multimedia objects. Our approach is to devise a metadata ontology

RE: [fileapi] urn - URL

2009-11-12 Thread paul.downey
Anne van Kesteren wrote: It would however be consistent with WebSocket.URL, input type=url, url(image), EventSource.URL, HTMLDocument.URL, etc. Keeping the author-facing APIs the same would be a good thing IMO. +1 I found the use of the URN scheme a little opaque and magical. -- Paul

Re: CfC: to publish Last Call Working Draft of XHR (1); deadline 18 November

2009-11-12 Thread Arthur Barstow
Anne, All, On Nov 10, 2009, at 5:01 PM, Barstow Art (Nokia-CIC/Boston) wrote: As with all of our CfCs, positive response is preferred and encouraged and silence will be assumed to be assent. The deadline for comments is November 18. I support this publication. Assuming we do get consensus

Re: CfC: to publish Last Call Working Draft of XHR (1); deadline 18 November

2009-11-12 Thread Anne van Kesteren
On Thu, 12 Nov 2009 12:49:22 +0100, Arthur Barstow art.bars...@nokia.com wrote: 1. Length of the comment period. 3 weeks is minimum and would be OK with me, especially since this spec has been previously published as a LCWD. Sounds good. 2. Who do we ask to review the LC, both W3C WGs and

Re: Use Cases and Requirements for Saving Files Securely

2009-11-12 Thread Charles McCathieNevile
On Wed, 11 Nov 2009 09:51:56 +0100, Maciej Stachowiak m...@apple.com wrote: On Nov 10, 2009, at 11:45 PM, Charles McCathieNevile wrote: On Tue, 10 Nov 2009 01:21:06 +0100, Maciej Stachowiak m...@apple.com wrote: On Nov 9, 2009, at 12:08 PM, Ian Hickson wrote: On Mon, 2 Nov 2009,

RE: [WARP] Comments to WARP spec

2009-11-12 Thread Marcin Hanclik
Hi, What about semantic distinctions? tag as proposed till now seems to be too detailed and does not scale. For HTML/XHR: script means an executable content retrieved from the remote host. img, video etc means a displayable content retrieved from the remote host. iframe means a container

Re: [WARP] Comments to WARP spec

2009-11-12 Thread Marcos Caceres
Marcin Hanclik wrote: Hi, What about semantic distinctions? tag as proposed till now seems to be too detailed and does not scale. For HTML/XHR: script means an executable content retrieved from the remote host. img,video etc means a displayable content retrieved from the remote host. iframe

[widgets] Draft Minutes for 12 November 2009 Voice Conference

2009-11-12 Thread Arthur Barstow
The draft minutes from the November 12 Widgets voice conference are available at the following and copied below: http://www.w3.org/2009/11/12-wam-minutes.html WG Members - if you have any comments, corrections, etc., please send them to the public-webapps mail list before 19 November 2009

Re: [XHR2] timeout

2009-11-12 Thread Anne van Kesteren
On Wed, 11 Nov 2009 00:03:07 +0100, Jonas Sicking jo...@sicking.cc wrote: On Tue, Nov 10, 2009 at 10:17 AM, Anne van Kesteren ann...@opera.com wrote: Anyway, do you have opinions on the synchronous case? Do you agree we should use TIMEOUT_ERR there? What do the people from Microsoft think?

RE: [WARP] Comments to WARP spec

2009-11-12 Thread Marcin Hanclik
Hi Marcos, I understand that too many details may not work or be an obstacle in the adoption. However, I derive that from the security point of view we still would like to distinguish at least between executable and non-executable content. The distinction between retrievable and submissible

Re: [WARP] Comments to WARP spec

2009-11-12 Thread Marcos Caceres
Marcin Hanclik wrote: Hi Marcos, I understand that too many details may not work or be an obstacle in the adoption. However, I derive that from the security point of view we still would like to distinguish at least between executable and non-executable content. I think this is established

Re: [widgets interface] Tests generated from WebIDL

2009-11-12 Thread Dominique Hazael-Massieux
Hi Marcos, I saw that the test suite for TWI was discussed on the WebApps call today: http://www.w3.org/2009/11/12-wam-minutes.html#item05 Since the discussion didn’t allude at all to my mail below about generated test cases, I thought I would point you to it explicitly in case you had missed

Re: [widgets interface] Tests generated from WebIDL

2009-11-12 Thread Dominique Hazael-Massieux
Le jeudi 12 novembre 2009 à 17:35 +0100, Marcos Caceres a écrit : On the other hand, automated test generation can generate a large number of test cases and is less prone to human errors. But, at the same time, it cannot test some things that are written in the prose. For example, a AU must

Re: [widgets interface] Tests generated from WebIDL

2009-11-12 Thread Marcos Caceres
Hi Dom, Dominique Hazael-Massieux wrote: Hi Marcos, I saw that the test suite for TWI was discussed on the WebApps call today: http://www.w3.org/2009/11/12-wam-minutes.html#item05 Since the discussion didn’t allude at all to my mail below about generated test cases, I thought I would point

Re: [widgets interface] Tests generated from WebIDL

2009-11-12 Thread Marcos Caceres
Dominique Hazael-Massieux wrote: Le jeudi 12 novembre 2009 à 17:35 +0100, Marcos Caceres a écrit : On the other hand, automated test generation can generate a large number of test cases and is less prone to human errors. But, at the same time, it cannot test some things that are written in

Re: [widgets interface] Tests generated from WebIDL

2009-11-12 Thread Dominique Hazael-Massieux
Le jeudi 12 novembre 2009 à 17:52 +0100, Marcos Caceres a écrit : I complete agree that manual tests bring a lot of value, but I think it would be unwise to refuse automated tests that express exactly what the spec expresses — in particular, they can be extremely useful to detect bugs in

Re: [widgets interface] Tests generated from WebIDL

2009-11-12 Thread Marcos Caceres
Dominique Hazael-Massieux wrote: Le jeudi 12 novembre 2009 à 17:52 +0100, Marcos Caceres a écrit : I complete agree that manual tests bring a lot of value, but I think it would be unwise to refuse automated tests that express exactly what the spec expresses — in particular, they can be

RE: [WARP] Comments to WARP spec

2009-11-12 Thread SULLIVAN, BRYAN L (ATTCINW)
Hi Marcos, Opera 9.5 running on Windows Mobile 6.1 and Opera 10 running on PC both allow access to scripts and images from different domains than a widget was obtained from. I have tested this and can provide a working example (see below for the index.html - package it yourself and see). Thus

Re: What do we mean by parking Web Database? [Was: Re: TPAC report day 2]

2009-11-12 Thread Jonas Sicking
On Mon, Nov 9, 2009 at 12:58 AM, Maciej Stachowiak m...@apple.com wrote: On Nov 8, 2009, at 11:12 PM, Jonas Sicking wrote: -Regards, Art Barstow [1] http://www.w3.org/2009/11/02-webapps-minutes.html#item12 [2] http://lists.w3.org/Archives/Public/public-webapps/2009OctDec/0477.html From a