Re: [manifest] Fetching restriction, Re: [manifest] Update and call for review

2014-05-28 Thread Ben Francis
On Tue, May 27, 2014 at 5:11 PM, Marcos Caceres w...@marcosc.com wrote: The only way one could do what you describe would be for my own app store to host its own manifests. So: http://myownappstore.com/gmail/index.html Would contain: link rel=manifest

Re: [manifest] Fetching restriction, Re: [manifest] Update and call for review

2014-05-28 Thread Anne van Kesteren
On Tue, May 27, 2014 at 9:53 PM, Marcos Caceres w...@marcosc.com wrote: On May 27, 2014 at 3:31:15 PM, Ben Francis (bfran...@mozilla.com) wrote: One risk of allowing cross-origin manifests might be that these tailored app experiences are perceived by the actual app author and/or end users as a

Re: [manifest] Fetching restriction, Re: [manifest] Update and call for review

2014-05-28 Thread Mounir Lamouri
On Wed, 28 May 2014, at 8:59, Jonas Sicking wrote: On Tue, May 27, 2014 at 12:39 PM, Marcos Caceres w...@marcosc.com wrote: On May 27, 2014 at 2:30:32 PM, Jonas Sicking (jo...@sicking.cc) wrote: On Tue, May 27, 2014 at 9:11 AM, Marcos Caceres wrote: The only way that gmail would allow

Re: [manifest] Fetching restriction, Re: [manifest] Update and call for review

2014-05-28 Thread Anne van Kesteren
On Wed, May 28, 2014 at 12:20 PM, Mounir Lamouri mou...@lamouri.fr wrote: Then, it might make sense to have the manifest same origin as the web page because obviously making start_url same origin as the manifest would be moot if the manifest doesn't have to be same origin with the web page ;)

Re: [manifest] Fetching restriction, Re: [manifest] Update and call for review

2014-05-28 Thread Marcos Caceres
On Wednesday, May 28, 2014, Anne van Kesteren ann...@annevk.nl wrote: On Wed, May 28, 2014 at 12:20 PM, Mounir Lamouri mou...@lamouri.frjavascript:; wrote: Then, it might make sense to have the manifest same origin as the web page because obviously making start_url same origin as the

Re: [manifest] Fetching restriction, Re: [manifest] Update and call for review

2014-05-27 Thread Anne van Kesteren
On Tue, May 27, 2014 at 6:11 PM, Marcos Caceres w...@marcosc.com wrote: Where this could become a problem in the future is if manifests start granting elevated privileges (e.g., access to specific APIs or unlimited storage). However, the security model could then be refined so that, for

Re: [manifest] Fetching restriction, Re: [manifest] Update and call for review

2014-05-27 Thread Jonas Sicking
On Tue, May 27, 2014 at 9:11 AM, Marcos Caceres w...@marcosc.com wrote: On May 27, 2014 at 9:25:26 AM, Ben Francis (bfran...@mozilla.com) wrote: As per our conversation in IRC, something else I'd like to highlight is the fact that in the current version of the spec any web site can host an

Re: [manifest] Fetching restriction, Re: [manifest] Update and call for review

2014-05-27 Thread Marcos Caceres
On May 27, 2014 at 2:30:32 PM, Jonas Sicking (jo...@sicking.cc) wrote: On Tue, May 27, 2014 at 9:11 AM, Marcos Caceres wrote: The only way that gmail would allow my own app store to use its manifest would be for Google to include the HTTP header: Access-Control-Allow-Origin:

Re: [manifest] Fetching restriction, Re: [manifest] Update and call for review

2014-05-27 Thread Marcos Caceres
On May 27, 2014 at 3:31:15 PM, Ben Francis (bfran...@mozilla.com) wrote: To be clear, this is the case I was talking about. The benefit is that it makes it much easier to build a large app store of tailored app experiences for sites that lack manifests without the involvement of app

Re: [manifest] Fetching restriction, Re: [manifest] Update and call for review

2014-05-27 Thread Marcos Caceres
On Tuesday, May 27, 2014, Jonas Sicking jo...@sicking.cc wrote: On Tue, May 27, 2014 at 12:39 PM, Marcos Caceres w...@marcosc.comjavascript:; wrote: On May 27, 2014 at 2:30:32 PM, Jonas Sicking (jo...@sicking.cc) wrote: On Tue, May 27, 2014 at 9:11 AM, Marcos Caceres wrote: The